Back to skill

Security audit

智慧芽-专利权利要求翻译

Security checks across malware telemetry and agentic risk

Overview

The skill does retrieve patent-claim translations, but it also includes account login, API-key generation, payment-order creation, and persistent secret/data handling that users should review carefully before installing.

Install only if you are comfortable letting this skill contact LinkFox/PatSnap services with an API key, save full patent-query results locally, and guide users through LinkFox account, API-key, and payment flows. Avoid entering OTP codes or making payment orders unless you intended to manage a LinkFox account, and prefer setting secrets through a secure secret store rather than permanent shell-profile commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
with urlopen(req, timeout=150) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill documentation instructs use of environment variables, network access, and automatic file writes, but no declared permissions are present. This creates a transparency and consent problem: users and policy layers cannot accurately assess that the skill can read secrets, contact external services, and persist data locally. In this context, the combination is moderately risky because the skill handles paid API access and writes retrieved patent data into the current project directory by default.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as a patent-claims retrieval tool, but the referenced behavior includes account login, API key generation, billing plan listing, payment order creation, QR-code payment, and order-status queries. That is a significant capability expansion into authentication and payments, which can expose users to credential handling, unintended purchases, and data exfiltration beyond the stated purpose. In a narrow data-retrieval skill, this mismatch is especially dangerous because users would not reasonably expect financial or account-management actions.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The documentation adds authentication recovery, phone-based registration, and billing workflows that are outside the skill’s declared purpose of retrieving translated patent claims. This scope expansion is dangerous because it enables the skill to solicit credentials, account data, and payment actions under the cover of a content-retrieval feature, increasing phishing and misuse risk.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The documented ability to collect a phone number, send a verification code, log in a user, and initiate subscription purchases is not justified by the stated skill function. In this context, these are high-risk account and payment operations that could be abused for unauthorized account creation, account takeover assistance, or deceptive payment redirection.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill is declared as a patent-claim retrieval/translation capability, but this file implements a full onboarding and commerce workflow including SMS login, API-key acquisition, package listing, ordering, and payment QR generation. This mismatch materially increases risk because users and reviewers may grant trust or permissions appropriate for translation while the code performs unrelated account and financial operations.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code contains billing capabilities such as package retrieval, order creation, and payment QR generation that are not justified by the declared patent-claim translation purpose. In a skill ecosystem, hidden commerce logic can be abused to initiate purchases or socially engineer users into payment flows under false pretenses.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
This section performs SMS-based authentication, token exchange, team discovery, and API-token generation, none of which are necessary for simply retrieving translated patent claims for an end user. Because it collects login factors and produces reusable API keys, the undeclared functionality creates significant credential theft and account takeover risk.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The module docstring openly describes an account onboarding CLI rather than a patent-claim translation tool, directly contradicting the skill's stated purpose. Such misalignment is a strong indicator of deceptive packaging and raises the likelihood that users will be exposed to sensitive operations they did not intend to invoke.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that full responses are always written to a path under the current working directory, but it does not prominently warn users that potentially sensitive patent claim data will be persisted in the project workspace by default. This can lead to unintended retention, inclusion in source control, leakage to collaborators, or later reuse by other tools that scan the directory. The risk is elevated because the write is mandatory rather than opt-in.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The markdown instructs handling a user’s phone number and one-time verification code without any warning about sensitivity, storage, or impersonation risk. OTPs are authentication secrets, so prompting an agent to collect and transmit them can facilitate credential theft or unauthorized access if mishandled.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The instructions tell users to persist API keys into shell startup files, modifying local environment configuration without warning about permanence, shell-profile side effects, or secret exposure risk. This can leave sensitive keys stored long-term in plaintext and may affect future sessions or be disclosed through backups, dotfile syncing, or local compromise.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code retrieves or generates an API token and returns it without any visible warning, consent checkpoint, or guidance on secure handling. In this context, exposing a reusable API key from a skill that users expect to perform translation increases the chance of accidental credential disclosure, overbroad access, or downstream misuse.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
90% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.