ClawHub
Back to skill

Security audit

Patent Portfolio Strategy · PatentMax

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real PatentMax reporting client, but it sends sensitive patent strategy data to an external service and includes an under-scoped endpoint override that could redirect credentials and submissions.

Review before installing if you will submit confidential inventions, unpublished product plans, budgets, customer timing, or competitor strategy. Use only a trusted environment, do not set PATENTMAX_BASE_URL unless you intentionally trust that endpoint, understand that a trial/API key may be stored under ~/.patentmax, and expect generated DOCX/JSON reports to remain on disk.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The trial-key registration request also uses the environment-controlled BASE_URL, allowing redirection to an attacker-controlled endpoint. While this call may not yet include a bearer token, it still leaks usage metadata and can trick the tool into storing attacker-supplied API keys for later authenticated exfiltration.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 134)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The destination host is taken from PATENTMAX_BASE_URL and used for authenticated requests, including the Authorization bearer token. If an attacker can influence environment variables or the skill runtime configuration, they can redirect traffic to a hostile server and capture API keys plus all submitted patent materials, which are highly sensitive business data.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 217)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Lp1

High
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The script performs outbound network calls to a third-party API but the capability is apparently undeclared. In an agent ecosystem, undeclared network egress is a real security concern because it can transmit sensitive patent strategy, competitor, budget, and disclosure-timing data off-platform without explicit permission review.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The script performs outbound network calls to a third-party API but the capability is apparently undeclared. In an agent ecosystem, undeclared network egress is a real security concern because it can transmit sensitive patent strategy, competitor, budget, and disclosure-timing data off-platform without explicit permission review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The skill directs users to obtain a trial automatically and later register for an API key with an external service, implying network transmission to api.ip930.com and local credential handling. In this skill's context, users may submit sensitive R&D strategy, patent plans, markets, budgets, and design-around considerations, so sending that material to a third-party API creates a real confidentiality and data-governance risk if not clearly disclosed and controlled.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

不需要密钥，装上就能用。 第一次运行时脚本自动领取一份免费试用：累计 ¥40 额度、30 天有效，存在本机 ~/.patentmax/。

试用用完后，在 api.ip930.com 注册（再送 ¥50 体验额度）并创建密钥，设成环境变量即可，设了就不再用试用：

bash
export PATENTMAX_API_KEY="pm_live_你的密钥"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description is primarily in Chinese and includes explicit Chinese example utterances, while the rest of the skill repeatedly instructs the agent to relay messages '原样转述' and present fixed Chinese text to the user. There is no opt-in or alternative language path documented, so the skill appears to enforce a specific language/locale without user choice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill explicitly directs creation and storage of deliverable files in the current working directory, and repeated polling/download flows increase the chance of persistent artifacts being left behind. In a multi-tool or shared workspace environment, those artifacts could be discovered, overwritten, or reused unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
author: PatentMax
user-invocable: true
argument-hint: "[技术方向 / 决策问题]"
allowed-tools: Bash, Read, Write
---

# 专利布局规划 · PatentMax

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill explicitly directs creation and storage of deliverable files in the current working directory, and repeated polling/download flows increase the chance of persistent artifacts being left behind. In a multi-tool or shared workspace environment, those artifacts could be discovered, overwritten, or reused unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
author: PatentMax
user-invocable: true
argument-hint: "[技术方向 / 决策问题]"
allowed-tools: Bash, Read, Write
---

# 专利布局规划 · PatentMax

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire guide is written as mandatory Chinese-language operator guidance, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regulatory or regional context. This can violate a language/locale policy when a skill constrains communication to a specific language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The FAQ states that the script '已强制 UTF-8 输出' in a section specifically about Chinese garbling, and elsewhere the document is entirely oriented around Chinese-stage descriptions. This indicates a language/locale constraint being imposed by the skill rather than offered as a user choice, which fits the policy category for forced language behavior without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The explicit curl example demonstrates outbound transmission to a third-party endpoint and includes authorization-based access to process report content externally. Given the skill's purpose, the payload can contain commercially sensitive technical subjects and roadmap context, making this more dangerous than generic telemetry because it can disclose strategic IP and product information.

Content

Scanner excerpt · references/faq.md (reported line 125)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The explicit curl example demonstrates outbound transmission to a third-party endpoint and includes authorization-based access to process report content externally. Given the skill's purpose, the payload can contain commercially sensitive technical subjects and roadmap context, making this more dangerous than generic telemetry because it can disclose strategic IP and product information.

Content

Scanner excerpt · references/faq.md (reported line 125)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This file's operational instructions and user-facing phrasing are all in Chinese, which effectively forces a specific language for use of the skill. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; neither is stated here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 8)May include surrounding context.

python
**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞几十分钟，用户就几十分钟什么都看不到，宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   完成了（Word 报告已自动下载到提交时的目录）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 8)May include surrounding context.

python
**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞几十分钟,用户就几十分钟什么都看不到,宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   完成了(Word 报告已自动下载到提交时的目录)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The docstring says the error message is user-facing Chinese text to be relayed verbatim, and the rest of the script consistently emits Chinese-only user messages. This enforces a language choice without offering user selection or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 25)May include surrounding context.

md
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "patent-portfolio-strategy"
TRIAL_GROUP = "roadmap"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 92)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "patent-portfolio-strategy"
TRIAL_GROUP = "roadmap"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 171)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "patent-portfolio-strategy"
TRIAL_GROUP = "roadmap"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

When no API key is configured, the tool silently auto-registers a free-trial key and stores it locally. This creates an external account/credential side effect without clear point-of-use consent, which is risky in agent environments where users may not realize the skill is contacting a vendor and persisting credentials under their home directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

文档标题、说明、示例与行为描述均以中文呈现，未见提供其他语言选项或声明这是仅面向中文用户/特定区域的技能。按规则，若技能强制特定语言而未提供用户选择或明确、合理的区域性说明，可构成语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该说明提到脚本会“自动领取一份免费试用”并“存在本机 ~/.patentmax/”，这属于会修改本地文件系统并持久化保存服务相关状态的行为。虽然文中描述了位置，但没有明确提醒这会在本机写入和保存哪些类型的数据、是否包含令牌或账户标识，以及用户如需避免/清理应怎么做。

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/patentmax_roadmap.py (reported line 388)May include surrounding context.

python
die(f"业务约束里有不认识的字段：{', '.join(unknown)}。可用字段见 fields 子命令。", EXIT_INPUT)
        context.update({k: str(v).strip() for k, v in loaded.items() if str(v).strip()})
    for key in CONTEXT_FIELDS:
        value = getattr(args, key, None)
        if value and value.strip():
            context[key] = value.strip()
    return context

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The tool automatically creates an output directory and writes both a .docx report and a full JSON result file to local storage. While this behavior is part of the workflow, the file-write operation itself has no print/log disclosure immediately before writing, so users may not realize potentially sensitive patent materials are being saved locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.