Security audit

Google Patents

Security checks for vulnerabilities and agentic risk

Overview

This Google Patents skill mostly matches its stated purpose, but it ships a hardcoded SerpApi key and can write downloaded PDFs to caller-chosen paths.

Review before installing. Use only with your own SerpApi key after removing or rotating the embedded fallback key, avoid confidential patent queries unless you are comfortable sending them to SerpApi and fetched patent URLs, and be careful with the pdf output path because it can write wherever the invoking agent has filesystem permission.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/patents.sh:3
Finding: Hard-Coded SerpApi Credential Exposed and Transmitted in URL Query Strings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior understates the actual security-relevant actions: the skill relies on a third-party authenticated service (SerpApi), downloads and writes PDFs to local storage, and the finding indicates a hardcoded default API key fallback. This mismatch is dangerous because it can hide data egress, local file writes, and secret-handling risks from users and policy enforcement, and a baked-in key could expose unauthorized external service usage or credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script embeds a hardcoded fallback SerpAPI key, causing anyone who runs the skill without setting SERPAPI_API_KEY to use the same credential. This risks credential leakage, unauthorized API usage, quota exhaustion, billing abuse, and makes secret rotation and ownership tracking difficult.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable shell commands and network-backed behavior but does not declare any explicit tool scope such as allowed-tools or permissions. That creates a least-privilege failure: an agent or reviewer cannot clearly constrain or audit what external access the skill requires, increasing the chance of unintended command execution or network use beyond user expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The search action constructs a request containing the user's query and sends it to SerpAPI, but the script's help output does not warn that user-provided search terms are transmitted over the network to a third party. Under the code-file criteria, network calls that transmit user or system data should have some user disclosure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes searching Google Patents for research, infringement checks, and IP analysis, which implies retrieval and analysis of patent data. The pdf action goes further by saving a remote PDF to a user-specified local path, which is a file-writing behavior not conveyed by the description's search/analysis framing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The pdf command writes to an arbitrary local path through the user-controlled outfile argument without path restrictions or confirmation. In an agent setting, this broad file-write capability can be abused to overwrite files in unintended locations, making the skill more dangerous than a pure search/read-only tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script performs a local file write during PDF download without warning, confirmation, or confinement to a safe location. In an agent context, undisclosed filesystem modification can surprise operators and can be leveraged to place files where they were not intended, especially when the output path is caller-controlled.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.