睿观-实用新型专利检测

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:38 PM UTC
• Version: 1.0.6

Overview

This patent-checking skill also handles login, API keys, payments, broad network endpoints, and saved local data, so it should go through Review before installation.

Install only if you are comfortable letting the skill send product descriptions and patent-search inputs to LinkFox/Ruiguan, use or generate a LinkFox API key, guide phone/SMS login, and create payment orders when credits are insufficient. Avoid using it with confidential unreleased product details unless you have reviewed the service terms, and treat any API key printed by the script as a secret that may appear in logs or transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The POST target URL is derived from environment-controlled base URLs and then used to send login data, access tokens, refresh tokens, phone numbers, SMS codes, and API-token requests. If an attacker can influence environment variables in the skill runtime, they can redirect these authenticated requests to attacker-controlled infrastructure and exfiltrate credentials and personal data.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 93% confidence
• Finding: The gateway request uses a URL built from environment-controlled base configuration and attaches the API key in the Authorization header. An attacker who can set LINKFOX_AGENT_API_URL or related variables can cause the script to send the bearer credential and account/order data to an arbitrary host.

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""

• Confidence: 95% confidence
• Finding: The request sent via urlopen is built from multiple environment-controlled values, including the gateway base URL and several headers such as SESSION_ID, MODE_ID, and APP_NAME. If an attacker can influence LINKFOX_TOOL_GATEWAY, the script will send the API key and user-supplied patent-search data to an arbitrary host, creating a credential exfiltration and data-leak path rather than a simple configuration issue.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes environment variables, network access, and file writes but does not declare these capabilities, preventing meaningful user or platform review of what the skill can actually do. In this skill's context, those hidden capabilities matter because it accesses API credentials, calls external services, and persists responses to disk, increasing the chance of unexpected data exposure or unauthorized side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is patent-risk analysis, but the detected behavior extends into account login, API key acquisition, package discovery, paid order creation, payment QR generation, and order-status checks against account and payment services. That mismatch is dangerous because it can trigger sensitive authentication and financial flows outside the user's expected task boundary, making consent and risk understanding inadequate.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements account onboarding, SMS login, API-key issuance, plan listing, and payment workflows, which are unrelated to a patent-detection skill's declared purpose. Such capability expansion is dangerous because it collects credentials and enables account and billing actions under the cover of an unrelated skill, increasing the chance of deceptive data capture and unauthorized transactions.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The script can create orders, expose payment URLs, and render payment QR codes, despite the skill being described as a patent detection/search tool. In this context, embedded billing flows are especially risky because they can trigger or facilitate purchases unrelated to the user's expected interaction with the skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script sends SMS verification codes, logs users in, and generates or retrieves API keys, none of which are justified by the patent-risk analysis use case. In this skill context, harvesting phone-based authentication and issuing credentials is more suspicious because it creates a covert credential collection path unrelated to the advertised functionality.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script always persists full API responses plus session metadata to disk, which expands data handling well beyond making a patent-detection API call. Patent search inputs and outputs may contain sensitive business information about unreleased products, and local persistence increases exposure through later discovery, accidental sharing, or compromise of the workstation/project directory.

Intent-Code Divergence

High

• Confidence: 89% confidence
• Finding: The module documentation promises that writing to /tmp is forbidden and that failure to write the current directory will raise an error, but the implementation silently falls back to home and temporary directories. This mismatch is security-relevant because operators may rely on the documented storage boundary when handling sensitive patent-analysis data, yet the code can place it in less controlled locations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The API reference instructs the skill to send potentially sensitive product information and an authorization key to an external service, but it does not include any user-facing notice, consent guidance, or data-handling disclosure. In this skill context, product descriptions may contain confidential pre-launch product details, making undisclosed transmission to a third-party patent analysis service a meaningful privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow explicitly asks the agent to collect a user's phone number and use it to trigger registration/login commands, but it provides no privacy notice, consent language, retention guidance, or data-minimization constraints. This creates a real privacy and security risk because the agent may solicit and process personal data in chat and transmit it to backend tooling without making the exposure clear to the user.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The code writes payment QR code images to disk in a session directory without any visible warning in this file about local persistence. This can leave behind payment artifacts and potentially sensitive transaction links in shared workspaces or temporary directories where other users or processes may access them.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The login command emits the API key directly to stdout as JSON, which is commonly captured by logs, agent transcripts, shell history tooling, or downstream integrations. Exposing a long-lived credential this way materially increases the risk of credential leakage and subsequent unauthorized API access.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill requires saving complete API responses under a session-based path in the project directory, which may include user-provided product descriptions, search outputs, metadata, and possibly billing-related fields. Persisting full responses outside a tightly controlled temporary or encrypted store increases the risk of accidental disclosure to other tools, collaborators, repository sync, backups, or later tasks in the same workspace.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The feedback instructions encourage sending information whenever the user reacts or whenever the agent thinks something could be improved, without clear limits on what user content may be included. That broad transmission pattern can leak conversation details or commercially sensitive product information to a feedback endpoint beyond what is necessary for the immediate patent-check task.

External Transmission

Medium

• Category: Data Exfiltration

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 84% confidence
• Finding: This code transmits sensitive user and authentication data to external services over the network. External transmission is especially concerning here because the same file handles SMS login, tokens, and API-key generation, so any endpoint misuse or logging weakness can leak highly sensitive data.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.