Security audit

谷歌专利检索

Security checks for vulnerabilities and agentic risk

Overview

This patent-search skill is not clearly harmful, but it also handles login, API-key creation, paid plan ordering, automatic feedback reporting, and saved search files, so it needs review before installation.

Install only if you are comfortable with LinkFox handling patent queries, API credentials, session metadata, phone/SMS onboarding data, paid-plan order creation, feedback reports, and local saved search results. Use it with explicit confirmation before login, token generation, feedback submission, or any purchase flow, and avoid using it for confidential patent research unless the local saved JSON files and provider data sharing are acceptable.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no permissions, yet its documented behavior clearly relies on environment variables, network access, and writing response files to the local workspace. This creates a transparency and consent problem: operators may approve or invoke the skill without realizing it can access secrets and persist data locally, which increases risk of unintended data exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a patent-search tool, but the referenced onboarding flow can introduce account login, API key generation, package/credit queries, order creation, recharge, and payment QR code workflows. That is a major behavior expansion into authentication and billing operations, which can manipulate a user into financial or account actions outside the stated purpose and materially raises phishing, unauthorized purchase, and credential-handling risk.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file documents a separate feedback API that is outside the skill’s declared patent-search functionality. In an agent setting, extra undocumented or weakly justified endpoints expand the action surface and can enable unintended data exfiltration or off-task network calls, especially if runtime logic later uses this documentation to justify sending user content externally.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documented feedback-reporting endpoint is not necessary for performing patent search and creates a secondary outbound channel to a different base URL. That mismatch is risky because an agent could be induced to transmit user prompts, search terms, or result summaries to a third party under the guise of feedback, violating least privilege and potentially exposing sensitive IP or legal-research intent.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file implements account onboarding, SMS login, API-key issuance, package listing, and payment flows, which are unrelated to the declared Google Patents search purpose. This mismatch is dangerous because users and hosts may authorize the skill expecting patent retrieval while it actually collects credentials and drives commercial account actions.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Embedding order creation, payment URL retrieval, and QR-code rendering inside a patent-search skill creates unjustified purchasing capability. In skill contexts, hidden payment flows are especially dangerous because they can induce unauthorized or deceptive transactions under the cover of an unrelated feature.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code performs phone-based authentication, SMS verification, token exchange, user/team discovery, and API-token generation despite the skill being described as patent search. This creates a credential collection and account bootstrap path that can harvest sensitive identifiers and mint reusable API keys unrelated to the stated function.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger language says the skill should activate even when the user does not explicitly mention Google Patents, as long as they want patent searching by keyword or bibliographic criteria. Overly broad triggers can cause the skill to run in contexts where the user intended a different patent source or a non-billable/general discussion, leading to unnecessary external calls, cost, and data disclosure to the provider.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill directs collection and handling of a user's phone number and one-time verification code to register for an API key, but provides no privacy notice, consent guidance, retention limits, or warning about sensitive credential handling. In an agent setting, this creates a real risk of unnecessary collection or exposure of personal data and authentication factors.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script always persists the full API response to local disk, including potentially sensitive patent research queries, results, and response metadata, regardless of user intent. In an agent/workspace setting, silent durable storage increases the chance of later disclosure through shared directories, logs, backups, or subsequent tool access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The request automatically sends SESSION_ID, MODE_ID, and APP_NAME from the environment to the remote service without explicit user awareness or necessity proof. These identifiers can reveal workflow, tenant, or application context and become sensitive metadata leakage, especially since this skill contacts an external gateway.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The code retrieves or generates API tokens and returns them without any in-file user warning or confirmation step. In an agent-skill context, silent token minting is risky because users may not realize a durable credential is being created and exposed through normal command output.

Static analysis

No suspicious patterns detected.