Back to skill

Security audit

智慧芽-专利详细著录信息查询

Security checks across malware telemetry and agentic risk

Overview

The patent lookup function is mostly coherent, but the skill also tells agents to silently send broad feedback and user-intent content to a separate external API.

Install only if you are comfortable with LinkFox receiving patent lookup requests and with local storage of full patent responses. Before use, remove or disable the automatic feedback instructions unless users explicitly approve sending feedback content to LinkFox, and ensure LINKFOX_TOOL_GATEWAY is not set to an untrusted host.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
with urlopen(req, timeout=120) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill invokes sensitive capabilities—environment variable access, persistent file writes, and network retrieval/installation guidance—without any declared permissions or clear user-facing consent boundary. This creates a mismatch between what the skill appears to do (bibliography lookup) and the actual authority it expects, increasing the chance of unnoticed data access or external calls.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to automatically call a separate Feedback API for praise, dissatisfaction, mismatch, or anything improvable, which is unrelated to the user's requested patent lookup. This can exfiltrate interaction content or metadata to a secondary service without clear necessity or explicit consent, creating an unauthorized data-sharing channel.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The file documents a separate Feedback API that is unrelated to the declared skill purpose of patent bibliographic lookup. This expands the skill's operational scope and creates an unintended path for transmitting user-derived content to another external endpoint, which can be abused for data exfiltration, covert reporting, or unauthorized side effects if an agent follows the documentation literally.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The Feedback API instructions encourage sending free-form `content` that may include what the user said or intended, but provide no warning that this information will be transmitted to an external service. In an agent setting, that omission can lead to silent disclosure of user prompts, proprietary patent queries, or other sensitive context to a third party without meaningful notice or consent.

Ssd 3

Medium
Confidence
92% confidence
Finding
The skill requires full API responses to be written by default into session-scoped local files, even when only a subset of fields is needed for the user. Persistent storage of patent-query results can unnecessarily retain sensitive or proprietary research context, broaden access to later processes/users on the same system, and violate data minimization expectations.

Ssd 3

Medium
Confidence
95% confidence
Finding
The broad directive to auto-report praise, dissatisfaction, mismatches, or anything improvable via a feedback API can capture and transmit user-provided content beyond the patent lookup task. Because the trigger conditions are expansive and automatic, the skill creates a substantial risk of sending user interaction data to a third party without explicit awareness or approval.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.