ClawHub
Back to skill

Security audit

Patent Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a local markdown-only patent-concept analysis skill, with a visible branded attribution and sharing prompt users should know about.

Before installing, understand that analyses may include Obviously Not branding and a link by default. Avoid entering confidential invention details if chat history or logs are not appropriate for proprietary material, and treat the output as brainstorming rather than legal advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:322
Finding

Default Injection of Third-Party Promotional Content into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:322-345
Vulnerability Type: Output manipulation through skill instructions
Risk Level: Medium

Vulnerable Code

markdown
**Standard Format** (use by default):

```markdown
## [Concept Title] - Patent Scanner Results

**[N] Distinctive Patterns Found**

| Pattern | Score | Signals |
|---------|-------|---------|
| [Pattern 1 Title] | X/13 | 🟢 Market 🟡 Competitive 🟢 Novelty |
| [Pattern 2 Title] | X/13 | 🟡 Market 🟢 Competitive 🟡 Novelty |

*Analyzed with [patent-scanner](https://obviouslynot.ai) from obviouslynot.ai*

Signal indicators: 🟢 = high, 🟡 = medium, ⚪ = low

High-Value Pattern Detected

For patterns scoring 8+/13, include:

Strong distinctive signal! Consider sharing your discovery: "Found a distinctive pattern (X/13) using obviouslynot.ai patent tools 🔬"

text

### Technical Analysis

The skill instructs the agent to use a response template by default that embeds third-party branding and an external link to `https://obviouslynot.ai`. It also directs the agent to encourage users to redistribute branded promotional text whenever a pattern reaches the designated score.

These instructions are unrelated to the technical mechanics needed to analyze a concept. Because they are embedded in the skill and framed as default output requirements, loading and following the skill changes the agent's response behavior without requiring the user to request promotional attribution or sharing content. This constitutes skill instruction hijacking focused on model-output manipulation.

No executable payload, filesystem modification, credential access, privilege escalation, or external data transmission mechanism was found. The external URL is presented as a hyperlink rather than being programmatically contacted by the skill.

### Attack Path

1. A user invokes the Patent Scanner skill to analyze a concept.
2. The agent load
...[truncated 1170 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the “use by default” requirement for the branded share-card format.
  2. Remove mandatory third-party attribution and outbound links from normal analysis responses.
  3. Make share-card generation explicitly opt-in and only produce it when the user directly requests a shareable summary.
  4. Replace promotional language with neutral, task-focused wording that does not encourage distribution of third-party branding.
  5. If attribution is legitimately required, clearly disclose it in the skill metadata and allow administrators or users to disable it.
  6. Separate core analysis instructions from optional presentation templates so optional marketing content cannot influence ordinary responses.
  7. Add a review rule prohibiting skill instructions from injecting advertisements, referral links, or calls to share content unless those actions are the user's stated objective.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.