睿观-外观专利检测

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:41 PM UTC
• Version: 1.0.6

Overview

This skill performs the advertised patent search, but it also handles account login, API keys, billing, public image uploads, automatic feedback, and persistent result storage with incomplete scoping.

Review this skill carefully before installing. Use it only if you are comfortable sending product images, product descriptions, account credentials, and billing actions through LinkFox services. Avoid using it with confidential product designs unless public upload and local persistence are acceptable, and prefer manually managing API keys and payments outside the agent when possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 97% confidence
• Finding: The script allows login and agent-user base URLs to be overridden via environment variables, then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API keys to those URLs with requests.post. In a skill or agent runtime where environment can be influenced by a host, wrapper, or attacker, this creates an SSRF/exfiltration path that can redirect authentication traffic to attacker-controlled endpoints.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is derived from environment variables and used to build urllib requests that include the Authorization header from LINKFOX_AGENT_API_KEY. If an attacker can influence the environment, API keys and related account/order operations can be sent to an attacker-controlled server, causing credential leakage and unauthorized actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its instructions clearly rely on environment variables, network access, and writing files to the local project directory. This creates a transparency and consent gap: the agent may handle credentials, make external requests, and persist data without an explicit permission model, increasing the chance of unintended data exposure or policy bypass.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is design-patent detection, but the skill also includes account onboarding, API-key acquisition, account/team queries, package purchasing, payment QR generation, order-status polling, and public image upload. These are materially different capabilities involving authentication, billing, and data transfer, which broaden the attack surface and can lead to unauthorized charges, account misuse, or disclosure of user images to third-party infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill adds an unrelated feedback-reporting function that can transmit user interactions or judgments to an external API without being part of the core patent-detection task. Even if intended for quality improvement, this expands outbound data flows and may leak user content, sentiment, or task context beyond what the user expects.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documentation introduces a separate external feedback-submission API that is not required for the core patent-detection function. In an agent setting, this can cause user data or conversation-derived content to be sent to an additional endpoint without clear necessity, consent, or tight scoping, expanding the skill's data-exfiltration surface.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file introduces authentication recovery, phone-based onboarding, and billing workflows that are outside the declared purpose of a design-patent detection skill. Scope creep like this is dangerous because it gives the agent authority to handle credentials, account setup, and payment-related actions that users would not reasonably expect from the skill’s stated function, increasing the attack surface for social engineering and unauthorized data handling.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly instructs the agent to support phone verification, login, key retrieval, and plan purchase guidance, none of which are justified by the patent-analysis scope. This is risky because it can induce collection of personal data and facilitate account actions or payment flows under misleading context, enabling phishing-like behavior or abuse of user trust.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This skill is described as a patent/design infringement detection capability, but the code implements account onboarding, SMS login, API token generation, package listing, order creation, and payment QR rendering. That mismatch is dangerous because users and reviewers may grant the skill broader trust than warranted, while the code is actually capable of handling credentials and monetization flows unrelated to the declared purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file contains commerce functions for plan purchase, order creation, and payment QR generation even though the stated use case is patent-detection. Unnecessary payment capability expands the blast radius from simple data processing to financial actions, increasing the risk of unauthorized charges, social engineering, or abuse through a misleading skill surface.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The docstring explicitly promises writing only under the current working directory and forbids /tmp, but _linkfox_root() falls back to the home directory and then the system temp directory. This discrepancy can cause sensitive API responses to be persisted in locations with different retention, visibility, or cleanup properties than operators expect.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The comments state one file-output policy, but the actual implementation writes cache files under cwd/linkfox/.cache and may store full responses under alternate roots chosen by _linkfox_root(). Misleading inline documentation is security-relevant here because it obscures where potentially sensitive patent search results and metadata are persisted.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script adds a capability to upload arbitrary local images to remote object storage and returns a public URL, which is broader than a narrowly scoped patent-analysis function. In a skill context, extra data-exfiltration capabilities increase risk because user-provided local files are transmitted off-device and made accessible beyond the immediate analysis workflow.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script explicitly sets uploaded objects to public-read, making user images accessible to anyone with the URL. For patent-risk analysis, this is unnecessary and can expose confidential product designs or legal-sensitive evidence, especially because the tool then prints the public URL for downstream reuse.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger criteria are overly broad and can activate on generic mentions of patents, infringement, or IP risk, including cases outside design-patent image analysis. Over-triggering raises the likelihood that the agent invokes a networked, potentially billable, data-persisting workflow in contexts where the user did not intend it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API requires sending product image URLs and optionally product titles/descriptions to a third-party external service, but the documentation provides no privacy notice, consent guidance, or data-handling limitations. This is dangerous because product images and descriptions may contain proprietary, confidential, or personal information, and users may not realize their data is leaving the local agent environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The feedback API accepts free-form content and sends it to a separate external endpoint, yet the documentation does not warn that user-provided text may be transmitted outside the main tool flow. Free-form feedback can easily include personal data, confidential business context, or conversation excerpts, creating an avoidable leakage path.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the agent to ask for a user’s phone number and process login by SMS code without any explicit privacy notice, consent language, retention limits, or warning about handling personal data. Collecting authentication factors and phone numbers in a loosely scoped skill increases the risk of privacy violations, accidental leakage, and credential interception through agent-mediated workflows.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CLI emits a newly obtained or generated API key directly to stdout as JSON. In agent platforms, stdout is often captured by logs, parent processes, transcripts, or other tooling, so this can expose long-lived credentials beyond the intended recipient and enable later account misuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script always writes the full API response to disk, including potentially sensitive patent-analysis data, without any runtime consent prompt or prominent user-facing disclosure beyond comments. In an agent-skill context, automatic persistence can surprise users and expose data to later reads by other tools, users, or processes sharing the workspace.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The HTTP request sends user-supplied parameters plus environment-derived identifiers and authorization data to an external service without explicit runtime disclosure. In this skill context, users may provide product images or patent-risk inputs that are commercially sensitive, so undisclosed transmission to a remote gateway meaningfully increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script uploads a local file to a remote service and generates a public URL without any prominent user-facing warning or consent step. In this skill's context, users may assume a local-only patent check, so silent transmission and publication of product images creates privacy, confidentiality, and compliance risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to always persist full tool responses to disk in the current project directory and forbids using ephemeral locations. Persisting complete responses by default can retain sensitive user inputs, image URLs, account-related metadata, and third-party results longer than necessary, increasing exposure to other tools, collaborators, or later prompts in the same workspace.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The display rules require exhaustive disclosure of patent records, including all images, abstracts, specifications, inventors, and related enforcement details for flagged results. This goes beyond minimal-necessary presentation and can amplify leakage of user-provided context or third-party data into chat history, logs, or downstream systems.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 90% confidence
• Finding: This external transmission point is security-relevant because the destination URL can be influenced through environment-derived base URLs and the transmitted payloads include authentication and account data. In context, the concern is not merely that the code makes network requests, but that it can send sensitive credentials and tokens off-box to a potentially untrusted endpoint.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.