Prior Art Search · PatentMax

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 4:47 AM UTC
• Version: 1.1.2

Overview

This skill is a disclosed PatentMax prior-art search client that sends user-approved invention text to its API and saves expected local task/report files.

Install only if you are comfortable sending invention disclosures, drafts, and related technical details to PatentMax/api.ip930.com. Get permission before submitting confidential or pre-filing material, redact nonessential secrets when possible, and remember that local trial keys, task metadata, DOCX reports, and JSON results may remain on disk under ~/.patentmax and the chosen output directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 134)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            payload = json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as exc:
        _, message = _server_error(exc.read().decode("utf-8", "replace"))

Tainted flow: 'req' from os.environ.get (line 210, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 217)May include surrounding context.

python

req.add_header("Content-Type", "application/json")
    for key, value in (headers or {}).items():
        req.add_header(key, value)
    return urllib.request.urlopen(req, timeout=TIMEOUT)


def request(path, method="GET", body=None, headers=None, raw=False):

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

This skill performs outbound network access to a third-party API and uploads user-supplied technical solution text, but the finding indicates network capability is not declared. In this context, the payload can contain confidential invention disclosures, so undeclared egress is materially risky because operators and users may not realize sensitive IP is transmitted off-platform.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

This skill performs outbound network access to a third-party API and uploads user-supplied technical solution text, but the finding indicates network capability is not declared. In this context, the payload can contain confidential invention disclosures, so undeclared egress is materially risky because operators and users may not realize sensitive IP is transmitted off-platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README presents the entire skill interface and usage guidance only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking or China-specific users. Under the stated policy, a forced language/locale requirement without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill instructs users to send invention disclosures and related materials to an external third-party service (PatentMax) and even advertises automatic acquisition of a trial credential on first run. In the context of prior-art search, those inputs may contain confidential, pre-filing technical details, so transmitting them off-host can leak trade secrets, compromise patent strategy, or create compliance/privacy issues if users are not clearly warned and asked for consent.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

不需要密钥，装上就能用。 第一次运行时脚本自动领取一份免费试用：累计 ¥40 额度、30 天有效，存在本机 ~/.patentmax/。

试用用完后，在 api.ip930.com 注册（再送 ¥50 体验额度）并创建密钥，设成环境变量即可，设了就不再用试用：

bash

export PATENTMAX_API_KEY="pm_live_你的密钥"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger guidance includes broad natural-language phrases such as asking whether an idea is patentable or whether anyone has done it before. Those intents overlap with ordinary brainstorming, legal, research, or search-assistance requests, so the skill may be invoked when the user did not intend to start a paid prior-art workflow. In this skill’s context, mis-invocation is more dangerous because it can lead to unnecessary collection of sensitive invention details and initiation of a chargeable external task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The same Write capability and workflow create a session-persistence risk because task artifacts are intentionally saved to disk and can survive the current interaction. In a patent-analysis skill, that persistence can expose confidential invention content and task metadata to subsequent sessions or unrelated tooling, even if no direct exfiltration occurs.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: PatentMax
user-invocable: true
argument-hint: "[技术方案描述]"
allowed-tools: Bash, Read, Write
---

# 专利查新检索 · PatentMax

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The same Write capability and workflow create a session-persistence risk because task artifacts are intentionally saved to disk and can survive the current interaction. In a patent-analysis skill, that persistence can expose confidential invention content and task metadata to subsequent sessions or unrelated tooling, even if no direct exfiltration occurs.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: PatentMax
user-invocable: true
argument-hint: "[技术方案描述]"
allowed-tools: Bash, Read, Write
---

# 专利查新检索 · PatentMax

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions state that the error message is user-facing Chinese text, implying the skill should present responses in Chinese regardless of user preference. The file does not offer a language or locale opt-in, and the skill description includes substantial English content, so a fixed Chinese-only output policy is not clearly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This finding points to the same curl example that transmits report input and an Authorization bearer token to api.ip930.com. Because the skill handles novelty/patentability analysis, the transmitted content is especially sensitive: pre-publication invention disclosures can lose practical confidentiality value if shared improperly, and exposed API usage patterns may incur cost or account misuse if mishandled.

Content

Scanner excerpt · references/faq.md (reported line 133)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash

curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This finding points to the same curl example that transmits report input and an Authorization bearer token to api.ip930.com. Because the skill handles novelty/patentability analysis, the transmitted content is especially sensitive: pre-publication invention disclosures can lose practical confidentiality value if shared improperly, and exposed API usage patterns may incur cost or account misuse if mishandled.

Content

Scanner excerpt · references/faq.md (reported line 133)May include surrounding context.

实在没有就直接发 HTTP 请求：

bash

curl -s -X POST "https://api.ip930.com/api/v1/reports" \
  -H "Authorization: Bearer $PATENTMAX_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 自定义唯一串" \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill content is written entirely in Chinese and presents the guidance as the default operating language without any indication that users may choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 8)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时，要等命令结束才显示输出，
AI 中途也插不了话；一条命令阻塞几十分钟，用户就几十分钟什么都看不到，宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回，之后用 wait 接着等，每次最多 30 秒：

    退出码 0   完成了（Word 报告已自动下载到提交时的目录）
    退出码 10  还在生成：把输出里的「[进度]」行告诉用户，再运行一次 wait

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 8)May include surrounding context.

python

**每条命令最多跑 30 秒就返回。** WorkBuddy 这类宿主前台跑命令时,要等命令结束才显示输出,
AI 中途也插不了话;一条命令阻塞几十分钟,用户就几十分钟什么都看不到,宿主还可能把命令掐掉。
所以 create 提交后只等 15 秒就先返回,之后用 wait 接着等,每次最多 30 秒:

    退出码 0   完成了(Word 报告已自动下载到提交时的目录)
    退出码 10  还在生成:把输出里的「[进度]」行告诉用户,再运行一次 wait

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/faq.md (reported line 25)May include surrounding context.

md

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "prior-art-search"
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 92)May include surrounding context.

python

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "prior-art-search"
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/patentmax_novelty.py (reported line 171)May include surrounding context.

python

# 密钥版（TRIAL_SOURCE 为空）：必须设 PATENTMAX_API_KEY，不领试用。
TRIAL_SOURCE = "prior-art-search"
TRIAL_GROUP = "novelty"
TRIAL_REGISTER_URL = "https://api.ip930.com/features/api-platform"
KEY_FROM_TRIAL = False

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes natural-language guidance that the script has already been configured to '强制 UTF-8 输出'. That is a forced locale/encoding choice presented as mandatory behavior rather than an option, which matches the language/locale policy concern for all file types.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.