智慧芽-专利摘要附图查询

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:44 AM UTC
• Version: 1.0.7

Overview

The patent-image lookup function is mostly coherent, but the skill also includes account login, API-key generation, paid order creation, automatic feedback reporting, and persistent response storage that need careful review.

Install only if you are comfortable with LinkFox handling patent identifiers, API keys, phone/SMS login flows, paid credit purchases, and locally saved response files. Before use, avoid sharing one-time codes in chat when possible, verify the LinkFox endpoint environment variables are not overridden, and treat automatic feedback reporting and saved lookup history as data-retention risks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 94% confidence
• Finding: r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 94% confidence
• Finding: with urlopen(req, timeout=30) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill uses environment variables, network access, and persistent file writes but does not declare those capabilities up front. That deprives the host or reviewer of informed consent and makes it harder to enforce least privilege, especially since the skill writes API responses locally and calls external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a patent abstract-image lookup tool, but its referenced onboarding and feedback flows imply additional account, authentication, billing, and payment operations unrelated to the stated purpose. This mismatch can mislead users into invoking a skill that may handle phone numbers, login codes, API keys, account data, and purchase workflows beyond the expected patent lookup scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation adds a separate feedback submission API that is unrelated to the skill’s declared purpose of retrieving patent abstract images. In an agent setting, this expands the skill’s effective capability to exfiltrate user content or interaction details to a third-party endpoint, especially because the example instructs sending free-form content describing what the user said or intended.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a full onboarding and commerce CLI for account login, API-key acquisition, subscription discovery, and purchasing, which is unrelated to the declared patent abstract image lookup capability. Such scope mismatch is dangerous because users and reviewers may grant a patent-image skill access to credentials and billing flows it does not need, enabling unnecessary collection of secrets and monetization actions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code contains package enumeration, order creation, and payment QR rendering for WeChat/Alipay, none of which are justified by a patent abstract image retrieval skill. In context, embedded billing capability materially increases the risk of unauthorized purchases, social engineering, and covert monetization under the guise of a benign lookup feature.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The SMS verification, login, team enumeration, and API-token generation flow collects phone numbers and verification codes and then issues API keys for downstream use. For a patent-image lookup skill, this is excessive privilege acquisition and credential harvesting behavior, making the context significantly more suspicious and dangerous.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill persists full API responses plus session metadata and indexing files to disk, which exceeds the narrow functional need of fetching and displaying patent abstract images. This creates an unnecessary local data trail containing patent queries, results, and session identifiers that could be accessed later by other users, tools, or processes on the host.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module documentation promises that writing to /tmp is forbidden and failure should occur if the current directory is not writable, but the implementation silently falls back to home and temporary directories. This mismatch undermines operator expectations and can cause sensitive output to be written to less controlled locations, especially shared temp storage.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to activate on general requests about patent drawings or illustrations, even when the user may want analysis, full documents, or a different source. Over-triggering can cause unnecessary external queries and token consumption, which is more concerning here because the skill explicitly warns that each call can incur significant cost.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the script to always write full API responses to a persistent project directory, but the storage behavior is not presented as an explicit user-consent requirement before execution. Users may expect a transient lookup response, not local retention of query history and returned data in session-organized files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The onboarding instructions tell the agent to collect and process a user's phone number and verification code to register/login on the user's behalf, but provide no privacy notice, consent language, data minimization guidance, or handling restrictions. In an agent context, this creates a real risk of unnecessary collection of personal data and sensitive authentication factors, especially if logs, transcripts, or downstream tools retain that information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script always writes the full API response to disk before deciding what to print, without obtaining explicit runtime consent or warning at the write site. Even if the content is not secret in all cases, patent lookups and returned metadata may be sensitive or proprietary, so unconditional persistence increases exposure and retention risk.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Persistently logging full API responses in a session-organized directory creates a durable record of user patent queries and returned metadata that can outlive the immediate interaction. In shared workspaces or synced project directories, this increases the risk of unintended disclosure and data reuse outside the user's expectations.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Automatically reporting user praise, dissatisfaction, or anything improvable to a feedback API can transmit conversational content and user sentiment without explicit approval. Because the instruction is broad and non-specific, it risks over-collection of user data unrelated to the patent lookup itself.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.