Security audit

智慧芽-专利简单著录查询

Security checks across malware telemetry and agentic risk

Overview

The patent lookup function is coherent, but the skill adds automatic feedback reporting, remote skill installation guidance, and broad persistent local storage that users should review before installing.

Install only if you are comfortable with patent lookup requests being sent to LinkFox/Zhihuiya, full responses being saved locally, and the skill having instructions for automatic feedback reporting. Consider disabling or manually gating feedback reports and remote onboarding installation, and review or clean the local linkfox output/cache directories after sensitive research.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill uses sensitive capabilities—environment variables, network access, and persistent file writes—without declaring permissions or clearly constraining their use. This reduces transparency and informed consent, and makes it harder for a host agent or user to assess whether the skill may access credentials, call remote services, or persist returned data.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to download and install another skill from an external URL when onboarding guidance is missing. That creates a supply-chain and scope-expansion risk: a patent lookup skill should not bootstrap unrelated external components at runtime, especially from a remote archive, without strong verification and explicit user consent.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill mandates automatic Feedback API reporting for broad triggers such as user praise, dissatisfaction, or anything the agent thinks could be improved. This can exfiltrate user interactions and metadata beyond the core patent-lookup purpose without clear minimization, necessity, or consent.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is described as a patent bibliography lookup tool, but the documentation also includes a separate feedback submission API to a different external domain. This expands the skill's effective data flow beyond the stated purpose and creates a pathway for transmitting user-derived content off-platform without clear necessity or explicit user consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: A feedback submission capability is not justified by the skill's stated purpose of retrieving patent metadata, so its presence introduces unnecessary functionality and a possible exfiltration channel. Even if intended for product improvement, unrelated outbound APIs increase security risk because an agent may forward user prompts, outputs, or sensitive context that was never needed for the requested patent lookup.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill does more than query patent bibliography data: it persistently writes full API responses, cache entries, and session metadata to local disk. Even if patent data is not highly sensitive, request/response content, session identifiers, and usage metadata may contain confidential research context or identifiers, creating unintended local data retention and disclosure risk.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The docstring promises that writing to /tmp is forbidden and that failure to write to the current directory should error out, but the implementation silently falls back to home and temporary directories. This mismatch can cause data to be stored in less trusted or less expected locations, undermining user/operator assumptions about where patent query results and session artifacts are persisted.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger description is extremely broad, including many generic patent-related requests and even cases where the user does not mention the provider or bibliography explicitly. Over-broad activation can cause unintended invocation, unnecessary external API calls, unexpected cost incurrence, and accidental disclosure of user queries to a third-party service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill requires persistent local storage of full API responses in session-scoped files by default, but does not clearly require user-facing notice or consent before storing returned patent metadata on disk. Even if the data is not highly sensitive in all cases, forced persistence increases data retention, local exposure, and cross-task leakage risk beyond the immediate response.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The feedback section does not warn that submitting feedback sends user-provided content to a separate external endpoint, which undermines informed consent and privacy expectations. In an agent setting, this omission is dangerous because operators may treat the API as routine and unintentionally transmit sensitive user queries, patent interests, or generated summaries to a third party.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill instructs persistent logging of complete API responses into session-scoped files, which can retain user-requested data and returned records beyond the active interaction. This increases the chance of unintended disclosure through local filesystem access, future context ingestion, backups, or multi-user/session contamination.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.