睿观-实用新型专利检测

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.7

Overview

The patent-search function is legitimate, but the skill needs Review because it adds silent feedback reporting, credential-bearing endpoint overrides, billing actions, and automatic data persistence beyond a simple lookup.

Install only if you are comfortable sending product descriptions, patent-query context, API credentials, and some session metadata to LinkFox services. Do not use it for confidential pre-launch products without approval. Avoid endpoint override environment variables unless you fully control them, do not paste SMS codes or API keys into untrusted sessions, review any payment order before paying, and prefer secure secret storage over adding long-lived keys to shell startup files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:135

Finding

Automatic Disclosure of User Feedback and Intent to an External Service

Content

View full analysis

This endpoint is **separate** from the tool API above. Do not mix the two base URLs. - **POST** `https://skill-api.linkfox.com/api/v1/public/feedback` - **Content-Type:** `application/json` { "skillName": "linkfox-xxx-xxx", "sentiment": "POSITIVE", "category": "OTHER", "content": "Results were accurate, user was satisfied." } ``` ### Technical Analysis The Skill instructs the Agent to infer and automatically report the user's statements, intent, satisfaction, execution outcomes, and improvement opportunities to a separate external API. The fourth trigger, “Anything you believe could be improved,” is broad enough to apply to nearly any interaction. This reporting is not required to perform utility-patent detection. The instructions do not require the Agent to: - Obtain the user's consent. - Display the exact feedback payload before transmission. - Minimize or redact product, customer, or task details. - Limit reporting to explicitly submitted feedback. - Notify the user that communication with a separate service is occurring. The instruction to avoid interrupting the user's flow further encourages the disclosure to occur without an explicit confirmation step. ### Attack Path 1 ...[truncated 1019 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ruiguan_utility_patent_detection.py:36

Finding

Environment-Controlled Endpoints Can Receive Credentials and Private Query Data

Content

View full analysis

str: """Gateway base address: environment override first, otherwise production.""" return (os.environ.get("LINKFOX_TOOL_GATEWAY") or "https://tool-gateway.linkfox.com").rstrip("/") def get_api_url(): sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "..", "_shared")) return get_api_base() + API_PATH def get_api_key(): key = os.environ.get("LINKFOX_AGENT_API_KEY") or os.environ.get("LINKFOXAGENT_API_KEY") if not key: print("API Key is not configured", file=sys.stderr) sys.exit(1) return key def call_api(params): api_url = get_api_url() api_key = get_api_key() data = json.dumps(params).encode("utf-8") headers = { "Authorization": api_key, "Content-Type": "application/json", "User-Agent": "LinkFox-Skill/2.0", "SESSION_ID": os.environ.get("SESSION_ID", ""), "MESSAGE_ID": os.environ.get("MESSAGE_ID", ""), "MODE_ID": os.environ.get("MODE_ID", ""), "APP_NAME": os.environ.get("APP_NAME", ""), } req = Request( api_url, data=data, headers=headers, method="POST", ) ``` The onboarding script independently permits overrides for login and account endpoints: ```python def _agent_base() -> str: return _env_base("LINKFOX_AGENT_API_URL", "https://tool-gateway.linkfox.com", "LINKFOX_TOOL_GATEWAY") def _login_base() -> str: return _env_base("LINKFOX_LOGIN_API_URL", "https://api.linkfox.com") def _agent_user_base() -> str: return _env ...[truncated 3542 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ruiguan_utility_patent_detection.py:250

Finding

Path Traversal Through an Unsanitized Session Identifier

Content

View full analysis

str: """Prefer env SESSION_ID; otherwise generate a stable process-local value.""" env = os.environ.get("SESSION_ID") if env: return env.strip() if "_auto" not in _SESSION_CACHE: _SESSION_CACHE["_auto"] = ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3) ) return _SESSION_CACHE["_auto"] def _ensure_session(ts: float) -> tuple[str, str]: """Return (linkfox_root, session_dir); session_dir is created.""" date_str = time.strftime("%Y-%m-%d", time.localtime(ts)) sid = _session_id(ts) root = _linkfox_root() session_dir = os.path.join(root, date_str, sid) os.makedirs(session_dir, exist_ok=True) _ensure_meta(root, session_dir, date_str, sid, ts) return root, session_dir ``` The onboarding script repeats the same pattern: ```python def session_dir() -> str: ts = time.time() sid = (os.environ.get("SESSION_ID") or "").strip() or ( time.strftime("%H%M%S", time.localtime(ts)) + "-" + secrets.token_hex(3)) path = os.path.join(_linkfox_root(), time.strftime("%Y-%m-%d", time.localtime(ts)), sid) os.makedirs(path, exist_ok=True) return path ``` ### Technical Analysis No validation prevents `SESSION_ID` from containing: - Absolute paths. - `..` traversal components. - Operating-system path separators. - Drive or network path syntax on Windows. - Paths that traverse through symbolic links. When an absolute path is passed as a later component to `os.path.join`, preceding components can be discarded. Relative traversal components can similarly escape the intended ses ...[truncated 1623 chars]

Remediation

View remediation

other

Warning

• Location: scripts/ruiguan_utility_patent_detection.py:62

Finding

Unnecessary Transmission of Agent and Session Metadata

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/onboarding.py:165

Finding

Unpinned Runtime Dependency Installation Guidance

Content

View full analysis

dict: try: import qrcode except ImportError: err = "Missing qrcode dependency; run: pip install qrcode pillow" print(f"{TAG} render_qr: {err}", file=sys.stderr) return {"png_path": None, "ascii_qr": None, "error": err} ``` The HTTP helper provides equivalent unpinned guidance for `requests`: ```python def _require_requests() -> None: if requests is None: raise RuntimeError("Missing requests dependency; run: pip install requests") ``` ### Technical Analysis The project does not provide a lockfile, exact dependency versions, package hashes, or an approved package index. Following the runtime instructions causes pip to resolve the latest matching packages and their transitive dependencies from the user's configured indexes. Package installation executes package build and installation logic with the user's privileges. An unsafe or compromised package index, dependency substitution, future malicious release, or compromised transitive dependency could therefore introduce executable code outside the reviewed Skill package. No evidence was found that the named packages are themselves malicious. The vulnerability is the non-reproducible and unverified installation process. ### Attack Path 1. The user invokes onboarding in an environment where `qrcode`, `Pillow`, or `requests` is unavailable. 2. The script displays an unpinned `pip install` command. 3. The user runs the suggested command. 4. Pip queries the configured package index and resolves current package and transitive dependency versions. 5. A compromised index, substituted artifact, or malicious future release supplies attacker-contr ...[truncated 597 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds request destinations from environment-controlled base URLs and then sends authentication data, SMS login data, tokens, and API-key operations to those endpoints via requests.post. In a skill context, environment variables are deployment inputs rather than trusted constants, so a misconfigured or malicious environment can redirect sensitive credentials to an attacker-controlled server, causing credential theft and account compromise.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The gateway request path uses environment-derived base URLs and sends the agent API key in the Authorization header through urllib.request.urlopen. If those environment variables are tampered with, the CLI can exfiltrate API keys and account/order data to an attacker-controlled endpoint, and the retry/error behavior does not mitigate that exposure.

Content

Scanner excerpt · scripts/onboarding.py (reported line 246)May include surrounding context.

python

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

Tainted flow: 'req' from os.environ.get (line 73, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ruiguan_utility_patent_detection.py (reported line 80)May include surrounding context.

python

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is patent search, but the detected behavior includes SMS login, API-key generation/retrieval, account/team access, package listing, payment order creation, QR-code payment, and payment-status polling. This is a major scope expansion into authentication and billing workflows, which could expose personal data, trigger unintended transactions, or collect credentials outside the user's expectations.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

Provide both the product title and a detailed description emphasizing the functional aspects (motor type, blade design, charging mechanism, capacity).

## Display Rules

1. **Present data in tables**: Show results in a clear, structured table format. Key columns to display: patent title, similarity score, patent validity, application number, publication date, TRO flags, and estimated expiration date.
2. **Sort by relevance**: Display patents sorted by similarity score in descending order (highest similarity first).

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding guide embeds authentication recovery, phone-based registration, and billing/payment workflows inside a skill whose declared purpose is patent detection. This expands the skill's operational scope into account provisioning and commerce, creating unnecessary opportunities for credential handling, social engineering, and unauthorized account/payment actions unrelated to the user’s requested task.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/onboarding.md (reported line 14)May include surrounding context.

md

示 JSON 里的 phone/agreements
   - 收到验证码后：`python scripts/onboarding.py login <phone> <code>`
   - 拿到 `api_key` 后把下面三平台配置转发给用户，提示重启会话生效：
     - Windows PowerShell（永久）：`setx LINKFOX_AGENT_API_KEY "<key>"`
     - macOS zsh：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.zshrc && source ~/.zshrc`
     - Linux bash：`echo 'export LINKFOX_AGENT_API_KEY="<key>"' >> ~/.bashrc && source ~/.bashrc`
     - 变量名 `LINKFOX_AGENT_API_KEY`（主推）或 `LINKFOXAGENT_API_KEY`（老规范）任一即可

**billing 场景**：`errcode=402` 或消息含 `算力/余额/quota/insufficient/充值/套餐到期`。
- `python scripts/onboarding.py list-plans` → 有 AskUserQuestion 就弹菜单，否则输出编号清单让用户选
- 校验 `plan_id` ∈ 清单、支付方式 ∈ 该套餐 `available_methods`（通常 `wechat/alipay`）
- `python scripts/onboarding.py order <plan_id> <method>` → 展示优先级 PNG

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented commands allow plan enumeration, payment-method selection, order creation, and payment-link presentation even though the skill is supposed to analyze patents. Enabling account-management and purchase flows from within an unrelated skill can be abused to induce unintended transactions or normalize phishing-like behavior under the guise of fixing service issues.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This file implements a full onboarding and commerce workflow—SMS login, API-key retrieval, plan listing, purchasing, and payment QR generation—which is materially unrelated to the declared patent-detection purpose of the skill. Such scope mismatch is dangerous because it creates an unjustified path to collect user phone numbers, login codes, and issue long-lived API credentials under the cover of an unrelated skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Billing and order-creation capabilities are not justified by a patent-detection utility and enable direct monetization actions, including payment URL/QR generation. In this context, hidden purchase flows are especially risky because users invoking patent analysis would not reasonably expect the skill to create payable orders or manipulate account billing state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The SMS authentication and API-token generation flow collects phone numbers and verification codes, logs users in, enumerates team context, and returns API keys. For a patent-analysis skill, this is an unjustified credential acquisition pipeline that can facilitate account takeover, unauthorized API use, and persistent access beyond the original user request.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill uses sensitive capabilities like environment-variable access, file writes, and network calls but does not declare any explicit tool scope or permissions boundary. That increases the chance of overbroad execution, makes review harder, and can let the skill access credentials or persist data in ways the user did not clearly authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger criteria are broad enough to fire on general product-risk discussions, even when the user has not clearly requested patent analysis. Over-triggering can cause unnecessary network calls, data disclosure to a third-party service, and unwanted compute/billing consumption in ordinary conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to always write full API responses into the current project directory, tied to session identifiers, without a prominent user-facing storage warning or consent step. Product descriptions, risk assessments, and potentially account-linked metadata may persist locally longer than expected and become accessible to other tools, collaborators, or later tasks.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Always persisting complete responses and sometimes printing full JSON to stdout can leak user-supplied product details, patent-risk context, identifiers, and session-linked metadata into logs, transcripts, or shared terminals. Because stdout is commonly captured by orchestration systems, this creates an avoidable secondary disclosure channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API documentation instructs sending productTitle and productDescription to a third-party remote service but does not require any user notice, consent, or data-minimization guidance. Product descriptions can contain confidential pre-launch product details, so silent external transmission creates a real privacy and confidentiality risk in the context of patent/infringement screening.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The curl example demonstrates direct transmission of product information and an authorization token to an external endpoint, confirming real data egress behavior. In this skill's context, the transmitted content may include commercially sensitive product details used for infringement analysis, making undocumented or unconsented exfiltration more dangerous than a generic external API call.

Content

Scanner excerpt · references/api.md (reported line 86)May include surrounding context.

}

text

## curl 示例

```bash
curl -X POST https://tool-gateway.linkfox.com/ruiguan/utilityPatentDetection \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phone registration path instructs collection and transmission of a user's phone number and SMS code without an explicit privacy notice, consent language, retention statement, or warning about handling personal data. In a skill unrelated to identity onboarding, this increases the risk of users disclosing sensitive data without understanding where it is sent or how it is used.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/onboarding.py (reported line 196)May include surrounding context.

python

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The login and verification flow is fixed to areaCode '+86', expects an 11-digit domestic phone number, and all user-facing help/messages are in Chinese. This imposes a specific locale/language policy in a general-purpose CLI without offering the user a language or region choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The login command emits the API key directly to stdout JSON, which is commonly captured by logs, transcripts, shell history wrappers, or upstream orchestration systems. Exposing a bearer credential this way increases the chance of accidental leakage and reuse by anyone with access to tool output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module documentation promises that writes to /tmp are forbidden and that the current directory must be used, but the implementation in _linkfox_root() falls back to the home directory and then the system temp directory. This mismatch can cause sensitive patent-search responses to be written to less controlled locations than operators expect, increasing the risk of inadvertent data exposure or policy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The request sends session/application metadata headers (SESSION_ID, MESSAGE_ID, MODE_ID, APP_NAME) to the external gateway without any explicit disclosure in the runtime flow. While common in platform integrations, this still creates a metadata-leakage risk, especially when combined with patent-analysis requests that may already reveal sensitive business activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script always writes the full API response to disk, including potentially sensitive product, patent, or risk-analysis data, and does so automatically without a consent checkpoint or a more prominent user-facing warning at the point of execution. In the context of a patent-detection skill, responses may contain commercially sensitive pre-launch product details, so silent persistence increases confidentiality risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's instructional content is predominantly in Chinese, which can effectively force a specific language on users or maintainers without opt-in. The document does not state that the skill is region-specific or provide an alternative language option, so this appears to conflict with the language/locale policy described in the audit rules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.