Back to skill

Security audit

智慧芽-专利家族查询

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised patent-family lookup, but it also includes account registration, SMS-code login, API-key generation, payment ordering, and silent feedback submission paths that deserve careful review before installation.

Install only if you are comfortable with this skill handling LinkFox account setup, API keys, phone/SMS login, local result caching, and optional paid plan/order flows. Prefer using a pre-provisioned limited API key, avoid sharing SMS codes with the agent unless you explicitly intend account registration, confirm any paid operation before running it, and review or delete local linkfox output/cache files after sensitive patent research.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
94% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
with urlopen(req, timeout=120) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill declares no permissions while its documented behavior clearly relies on environment variables, network access, and mandatory file writes. This under-disclosure prevents proper user and platform review of what the skill can access and do, increasing the risk of unnoticed data exposure or unexpected side effects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented skill purpose is patent family lookup, but the broader referenced behavior includes SMS login, API key generation, user/team info access, subscription listing, payment order creation, QR code generation, and payment status checks. That is a major capability mismatch which could expose personal, account, and billing operations under the guise of a simple lookup tool.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The document embeds a second capability for posting feedback to a separate domain that is unrelated to the stated patent-family lookup function. In an agent-skill context, this expands the skill's effective scope and can enable unsolicited transmission of user-derived content to another endpoint, creating an exfiltration/privacy risk if the agent treats all documented APIs as allowed actions.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file documents authentication recovery, account registration, and billing workflows that are outside the stated purpose of a patent-family lookup skill. Embedding unrelated onboarding and payment guidance expands the skill’s operational scope, increases the chance an agent will collect credentials or personal data, and could be abused to steer users into account creation or purchases under the guise of a patent lookup.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The documented phone-based registration and plan-purchase flows are unjustified for a patent-family search capability and create unnecessary paths for collecting user phone numbers, login codes, and payment choices. In the context of an agent skill, this is dangerous because the agent may be induced to facilitate account provisioning and commercial transactions that users did not expect from a search tool.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file implements account onboarding, SMS login, API-key issuance, package listing, order creation, and payment QR generation, which is unrelated to the declared patent-family lookup skill. That mismatch is dangerous because it broadens the skill from information retrieval into credential collection and monetization flows users would not reasonably expect in this context.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Billing and payment capabilities are embedded in a skill whose purpose is patent-family lookup, creating unjustified access to purchasing flows and QR-code payment artifacts. In this context, the mismatch increases the risk of unauthorized charges, deceptive upsell behavior, or covert monetization under the guise of a benign research tool.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill performs SMS-based login and API-token acquisition despite being described as a patent-family lookup utility. Collecting authentication factors and minting API keys in an unrelated skill is especially dangerous because it enables credential harvesting and persistent account access beyond the user’s expected task.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The module documentation promises current-directory-only persistence and explicitly says not to write to /tmp, but the implementation falls back to ~/linkfox and the system temp directory. This mismatch can cause sensitive patent query results to be written to locations with different retention, visibility, or cleanup properties than operators expect, which is a security-relevant integrity and data-handling issue. In agent environments, such undocumented fallback storage increases the chance of accidental data exposure across sessions or users.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger text is intentionally broad and says to activate even when the user does not explicitly mention patent family, which can cause the skill to run on ambiguous requests. In a metered tool that can consume points and write outputs to disk, over-triggering increases the chance of unnecessary charges, unintended data handling, and confused-deputy behavior.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill mandates writing full API responses to a predictable local path under the working directory and does not prominently warn users about local persistence or privacy implications. Even if the data is not highly sensitive, patent research inputs and results may be confidential, and persistent local storage increases exposure to other tools, users, or later accidental disclosure.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The feedback documentation instructs sending free-form content that may include what the user said or intended, but provides no privacy notice, minimization guidance, or restrictions on sensitive data. This can lead to accidental disclosure of user inputs, proprietary patent-search interests, or other personal/business information to a third-party service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown instructs the operator to ask for a user’s phone number and process SMS-code-based registration without any privacy warning, retention limits, or safe-handling guidance. That creates a privacy and social-engineering risk because users may disclose sensitive contact data and one-time codes to an agent in a context unrelated to the skill’s core patent-search function.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The login command emits a freshly obtained API key to stdout without any protective handling or warning. In agent and CLI environments, stdout is often logged, persisted, or displayed to other components, so this can leak long-lived credentials to logs or downstream tools.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
89% confidence
Finding
requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.