专利翻译

• Outcome: Review
• Latest audit: Oct 20, 2026 · 11:14 AM UTC
• Version: 1.0.2

Overview

The patent translation workflow is coherent, but weaknesses in API-key protection and cache-file handling warrant review before use.

Prefer a version that restricts credential destinations, protects saved keys, and validates patent identifiers before file access. Until then, use public patent numbers and a limited trial credential in an isolated workspace. Avoid pasting production keys into chat, confirm charges, and approve any confidential technical details before sending them to PatentMax.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tainted flow: 'req' from os.environ.get (line 138, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 142)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        message = _server_message(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 333, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

Sending the API key to the intended PatentMax service is legitimate, but the client attaches it to an unrestricted configurable endpoint and uses urllib's automatic redirects without an origin check. An HTTP endpoint or a cross-origin redirect from a compromised or misconfigured service can expose the bearer credential; the code also reuses a saved production key without binding it to an endpoint.

Content

Scanner excerpt · scripts/patentmax_client.py (reported line 344)May include surrounding context.

python

req.add_header(key, value)

    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as response:
            payload = response.read()
            # 服务端每个响应都回本次实扣和扣完后的余额。记下来，供 _spent/_balance 输出。
            # 拿服务端的真值，而不是在本地累加估价：跨进程累加迟早算岔，

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied command exposes part of an API key rather than fetching or translating patent content. While using a patent-service credential could support the declared workflow, printing credential characters is an undeclared disclosure unrelated to the promised outputs. The chunk does not demonstrate transmission to an external destination.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Retrieving patent text is consistent with supporting the declared translation workflow. However, this code’s substantive functionality is a much broader patent-search and analytics toolkit, including several independently usable capabilities not disclosed by the description. Its CSV export is a candidate-patent ledger, not a terminology glossary, and its principal text outputs are JSON rather than translated Markdown. Credential handling, caching, and billing management are supporting implementation details rather than the basis for the mismatch. Other skill components could potentially perform translation, but the supplied chunk itself materially exceeds the declared scope and does not implement the promised transformation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied commands implement a patent screening and candidate-management workflow, not the declared foreign-patent translation workflow. They manage Chinese patent candidates and persist selection decisions, capabilities not described in the declared purpose. Although CSV export could support an Excel-compatible output, the exported content here is a candidate list, not a terminology glossary. No original-text retrieval or translation is shown in this chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Retrieving patent text could support the declared translation workflow. However, citation retrieval and similar-patent discovery are additional patent-research capabilities not described in the declared purpose. The supplied commands also target a fixed Chinese patent rather than a user-supplied foreign patent. The absence of translation in this chunk alone would not establish a mismatch, but the explicit citation and similarity searches do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied command runs the client's similar operation, which is a related-patent search rather than a supporting step that retrieves the original patent text for translation. This search capability and its fixed Chinese patent target are not described in the declared purpose. The chunk shows no translation or glossary generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied commands implement patent discovery and similarity searching, rather than retrieving a user-specified patent for translation. These are substantive search capabilities not disclosed in the declared purpose and are not merely supporting steps for fetching the named patent. The chunk shows no translation or glossary generation, although their absence from this partial snippet alone would not establish a mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Retrieving patent content can support the declared translation workflow. However, the supplied commands also expose broader patent research and report-illustration capabilities that are not described as part of translation or terminology extraction. The examples primarily target Chinese patents rather than the declared foreign-patent inputs. The mismatch rests on these additional capabilities, not merely on the absence of translation logic from this partial code chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The command performs a topical patent search, not an identifier-based lookup supporting translation of a specified patent. Searching can be a supporting retrieval detail, but this fixed subject query is not connected to the declared translation workflow. The supplied chunk shows no translation or glossary generation; the mismatch rests on the different search behavior, not merely on those steps being absent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Patent retrieval can support the declared translation workflow, but this command instead performs a company-specific applicant search. Discovering up to 50 patents associated with a fixed applicant is an undeclared search capability, not a demonstrated implementation step for translating an identified patent. The chunk shows no translation or glossary generation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied command targets a search endpoint with ds=cn and a fixed Chinese query. It neither uses a supplied foreign patent number nor performs translation or glossary generation. API authentication is an ordinary implementation detail, but the demonstrated search target and operation differ materially from the declared foreign-patent translation workflow. This assessment is limited to the supplied code chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

Patent retrieval can support the declared translation workflow, but this command conducts a broad, hard-coded topical search unrelated to any supplied patent number. That is a distinct discovery capability not described in the declared purpose. The chunk shows no translation or glossary generation, although their absence alone would not establish a mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

The supplied command performs subject-matter patent discovery, not retrieval by patent number. Its fixed battery-and-electrolyte query is not tied to the declared translation workflow. API authentication and network access are ordinary supporting details and are not themselves mismatches. Although this reference snippet may support a larger workflow, the behavior shown differs materially from the declared patent-specific retrieval task.

Content

No source excerpt is available for this finding.

Code capability 'env' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/patentmax_client.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 16)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

服务端自己完成内部寻址，这些前置调用不进用户账单。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 89)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/patent?pn=CN109761224A"

某一块上游取不到时，该字段为 null 并在 unavailable 里列出，其余照常返回；

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 114)May include surrounding context.

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  "https://api.ip930.com/api/claims?pn=CN109761224A"

只要同时需要两块以上，就用 /api/patent——它一口价，拆开单买反而贵。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 48)May include surrounding context.

服务端直接返回上次的结果、不再扣费；同一个键换了参数会被拒（400）；上一次还在处理中返回 409。

bash

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY" -H "Idempotency-Key: task42-search-1"   "https://api.ip930.com/api/search?q=%E6%B5%B8%E6%B2%A1%E5%BC%8F%E6%B6%B2%E5%86%B7&ds=cn&size=20"

网络超时、不确定上一次有没有成功时，用同一个键重发，不要换键。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 73)May include surrounding context.

curl -s -H "Authorization: Bearer $PATENTMAX_API_KEY"
--data-urlencode 'q=(固态电池 OR 全固态电池) AND 电解质'
--data-urlencode 'ds=all' --data-urlencode 'size=20'
-G "https://api.ip930.com/api/search"

text

> 检索式里有中文和括号，一定用 `--data-urlencode -G`，别手工拼 URL。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tools.md (reported line 668)May include surrounding context.

试用用完、过期，或想用其他功能（查新、交底书等）时，命令会返回带 "free_trial": true 的错误，message 里写着下一步怎么办（注册 PatentMax 再送 ¥50 体验额度），原样转告用户，不要自己换写法重试。

用户有自己的密钥时用环境变量传，避免写进命令历史；设了就一律用它，不会领试用。密钥在 api.ip930.com 控制台创建：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 35)May include surrounding context.

md

- **密钥复制不全。** 前后有没有多余空格、有没有漏掉尾部字符
- **少了 `Bearer ` 前缀。** 用 curl 时 header 必须是 `Authorization: Bearer pm_live_xxx`，只写密钥不行
- **密钥被撤销了。** 到 [控制台](https://api.ip930.com/features/api-platform)看状态

> 还有个容易踩的：如果请求里带了 `Authorization` 头，URL 上的 `?apikey=` 就不会被读取。两种方式选一种，别混用——带了一个格式错误的 header，正确的 URL 参数也会被忽略。

The reference instructs technical prior-art searching and applicant portfolio analysis, beyond the manifest’s patent-translation scope.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The manifest describes fetching a user-specified patent’s title, abstract, and claims for Chinese translation and glossary generation. Instead, L07–L50 prescribe broad technical searches, mandatory result sampling, candidate-pool filtering, and iterative searches; L54–L64 additionally direct applicant portfolio queries and prior-art conclusions. These are patent discovery and analysis workflows, not implementation details needed to retrieve and translate a specified patent.

Content

No source excerpt is available for this finding.

The search workflow lacks a privacy warning about sending user-derived technical queries to the patent-search service.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The broader workflow instructs the agent to construct service queries from the user's technical subject, including mechanisms and distinguishing features, without first checking whether those details are confidential or approved for external disclosure. This can expose unpublished invention details to the search provider; translating an already-public patent number is substantially less sensitive, and the example query itself contains no demonstrated secret.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.