专利排行榜

• Outcome: Review
• Latest audit: Oct 21, 2026 · 2:31 AM UTC
• Version: 1.0.0

Overview

The patent-ranking workflow fits its purpose, but weaknesses in API-key handling warrant review before use.

Queries go to PatentMax and calls may spend account credit. Avoid confidential invention details and pasting keys into chat. Use a limited-credit key through the environment. Before using an account key, ask the publisher to restrict authenticated destinations and redirects and secure saved-key storage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 142)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

Sending the API key to its intended service is legitimate, but this implementation attaches the bearer credential to an unrestricted configurable URL and uses urllib's default redirect handling, which can forward explicitly added Authorization headers across origins. An HTTP endpoint configuration or a redirect to an attacker-controlled origin can therefore expose the account credential; this is conditional credential leakage, not evidence of deliberate exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 344)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。
            # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied command exposes part of an API key rather than generating patent rankings. Although using an API credential could support patent data retrieval, printing its contents is not necessary for the declared functionality and is an undeclared credential-disclosure behavior. No external transmission is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied commands perform individual-patent research, with no visible scope selection, aggregation, leaderboard metrics, counting rules, or Excel-compatible export. Although patent retrieval could support leaderboard construction, this chunk does not show that connection and instead implements a materially different patent-analysis workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The statistics command is relevant to the declared purpose: it can request applicant or other Top-20 distributions for a supplied query. However, the supplied code is primarily a broad patent-search and analysis client, rather than a leaderboard generator. It neither calculates growth nor assembles the promised ranking spreadsheet and counting methodology. Authentication, caching, and budget management are supporting implementation details and are not independently treated as mismatches. This assessment is limited to the supplied code; another component could potentially implement the missing leaderboard workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied command performs a similar-patent lookup, not a leaderboard calculation. It shows no selection of a ranking scope, aggregation by patent owner, ranking by the declared metrics, or Excel-compatible export with counting rules. Although similarity search could support a broader patent workflow, the supplied chunk does not establish that supporting role.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied workflow is directed at finding patents similar to a technical proposal. It does not aggregate patents by organization, calculate ranking metrics, apply leaderboard counting rules, or produce an Excel-compatible leaderboard. Patent searching could support the declared purpose, but selecting the closest patent and expanding by semantic similarity serves a materially different objective in this chunk. No unrelated resource access is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied command targets one specific patent rather than selecting a scope, counting patents by entity, ranking results, or exporting a leaderboard. Although patent lookups could support a larger ranking workflow, no such connection is visible in this chunk. The client implementation is not supplied, so additional behavior cannot be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

Patent searching can reasonably support leaderboard construction and is not itself a mismatch. However, the chunk also exposes substantive patent-analysis and illustration capabilities that are not described by the leaderboard-focused declaration. The visible commands function as a general patent-retrieval toolkit rather than demonstrating the promised ranking workflow. This assessment is limited to the supplied commands; the underlying client implementation is not shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied command targets a claims endpoint for one fixed patent publication. It does not retrieve scope-level patent counts, calculate rankings or growth, state counting rules, or generate an Excel-compatible leaderboard. Although authenticated patent-data access could support the declared purpose, this particular claims lookup has no demonstrated role in producing the promised rankings. The API-key header itself is ordinary authentication, not evidence of credential exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The supplied commands focus on screening and managing individual patents, including coolant-related inclusion and exclusion examples. They do not show aggregation by organization or scope, leaderboard ranking, valid-invention counts, filing growth calculations, or counting-rule documentation. Candidate management could support a larger leaderboard workflow, but this chunk implements a materially different immediate function; CSV compatibility alone does not establish the declared ranking behavior.

Content

No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

The workflow sends user-provided search criteria to PatentMax without a privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 87% confidence

Finding

The workflow places user-provided technology and organization criteria into queries sent to an external patent service without explicitly warning that those criteria leave the local environment. Confidential research interests or unpublished project terminology could therefore be disclosed unintentionally; the clearly identified PatentMax integration makes this a transparency gap rather than evidence of covert exfiltration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

某一块上游取不到时，该字段为 null 并在 unavailable 里列出，其余照常返回；

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/claims?pn=CN109761224A"

只要同时需要两块以上，就用 /api/patent——它一口价，拆开单买反而贵。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.

md

- **密钥复制不全。** 前后有没有多余空格、有没有漏掉尾部字符
- **少了 `Bearer ` 前缀。** 用 curl 时 header 必须是 `Authorization: Bearer pm_live_xxx`，只写密钥不行
- **密钥被撤销了。** 到 [控制台](https://api.ip930.com/features/api-platform)看状态

> 还有个容易踩的：如果请求里带了 `Authorization` 头，URL 上的 `?apikey=` 就不会被读取。两种方式选一种，别混用——带了一个格式错误的 header，正确的 URL 参数也会被忽略。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1"   "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY"
--data-urlencode 'q=(固态电池 OR 全固态电池) AND 电解质'
--data-urlencode 'ds=all' --data-urlencode 'size=20'
-G "https://api.ip930.com/api/search"

text

> 检索式里有中文和括号，一定用 `--data-urlencode -G`，别手工拼 URL。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tools.md (reported line 668)May include surrounding context.

试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 41)May include surrounding context.

md

## 402 余额不足

到[控制台](https://api.ip930.com/features/api-platform)充值。

新账户的体验额度分两笔：注册送 ¥10，第一次调用成功后再送 ¥40。如果第二笔一直没到，确认第一次调用确实返回了 200——失败的调用不算。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 119)May include surrounding context.

md

## 花了多少钱

脚本每次返回都带 `_spent`（本次实扣）和 `_balance`（余额），**这两个数来自服务端，是真值**。
准确的流水到[控制台](https://api.ip930.com/features/api-platform)查。

| 调用 | 单价 |
| --- | --- |

The search workflow does not warn that technical search queries are sent to an external patent-search service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow directs the agent to submit technical search terms through a patent-search client without warning that potentially confidential invention details may leave the user's environment. Public patent-ranking queries are relatively low risk, but the broader instructions encourage searches derived from users' technical proposals, creating a plausible disclosure risk; the client implementation and destination are not available here to verify actual transmission or retention.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 124)May include surrounding context.

健康检查

bash

curl -s "https://api.ip930.com/api/v1/health"

不需要密钥，用来确认网络通不通。

Static analysis

No suspicious patterns detected.