Back to skill

Security audit

智慧芽-实用新型专利以图搜图

Security checks across malware telemetry and agentic risk

Overview

This patent image search skill is not clearly malicious, but it needs Review because it also handles sign-in, API keys, payments, public image uploads, automatic feedback, and persistent result logs.

Install only if you are comfortable with LinkFox handling your patent-search images, phone-based account onboarding, API keys, paid credit purchases, and locally saved result files. Avoid using confidential unreleased product images unless you accept that local files may be uploaded to a public URL, and review the generated files and shell configuration before sharing the workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
95% confidence
Finding
with urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 77, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
95% confidence
Finding
with urlopen(req, timeout=120) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises no explicit permissions, yet its documented behavior clearly uses environment variables, network access, and persistent file writes. This creates a transparency and consent gap: a caller may invoke a patent-search skill without realizing it can read local auth state, write session-scoped artifacts, and communicate with external services. In a skill context that already includes uploads and logging, undeclared capabilities increase the chance of unintended data exposure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill's declared purpose is patent image search, but the documented behavior extends into account login via SMS, API key generation, plan lookup, payment order creation, QR code generation, payment-status polling, and file upload. That is a major scope expansion into identity, billing, and data-transfer operations, which can surprise users and enable collection of phone numbers, auth tokens, and payment metadata under the guise of a search utility. Because the trigger is broad, this mismatch makes accidental invocation more dangerous.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill instructs the agent to upload arbitrary local image files to obtain a public URL, adding local file access and external exfiltration beyond the core purpose of searching by URL. Even if intended for convenience, this can expose sensitive local images or embedded metadata to a third-party service, especially when users may not understand that the result is a public URL valid for 24 hours.

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
The skill mandates automatic feedback reporting whenever certain conditions occur, regardless of whether the user asked for such reporting. This creates an unrelated outbound data flow that may transmit user interactions, dissatisfaction, or task details to another API without clear consent, which is unnecessary for core patent-search functionality.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This file implements SMS onboarding, account login, API-key issuance, package discovery, order creation, and payment QR generation, which are materially unrelated to a patent image search utility. Such scope expansion increases the attack surface and exposes users to credential handling and financial workflows that are not justified by the declared skill purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The code includes package listing, order creation, payment-state queries, and QR-code payment generation despite the skill being described as a patent image search tool. In this context, monetization and purchasing capabilities are especially risky because they can trigger external charges and expose the user to unintended financial actions.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The login flow fetches or generates a live API token for the user, which exceeds the minimum capability needed for a patent image search skill. Returning long-lived credentials to the caller materially increases the risk of credential theft, replay, and unauthorized downstream access.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script is expressly designed to upload a local image and return a publicly accessible URL valid for 24 hours. In a patent-search skill, this increases privacy and data-handling risk because users may provide sensitive product images, and making them public can expose confidential design details beyond the intended search workflow.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The script persistently stores full API responses plus session metadata, including session IDs, timestamps, called skills, and file paths, which goes beyond the minimum needed to perform a search. Full response bodies may contain sensitive search inputs, proprietary patent-analysis data, or user-associated metadata, creating unnecessary local data retention and a larger disclosure surface. In a multi-user or shared workspace agent environment, this persistence materially increases exposure.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The module documentation promises not to write to /tmp and to fail if the current directory is not writable, but the implementation silently falls back to home-directory and temporary-directory storage. This discrepancy can cause sensitive patent-search results and metadata to be written to less-controlled locations than operators expect, undermining security assumptions and incident response. The danger is amplified because users may rely on the documented storage guarantee when handling sensitive data.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger criteria are intentionally broad and instruct activation even when the user does not explicitly mention Zhihuiya or patent images. Overbroad triggering increases the chance that the skill will run in contexts where the user did not intend an external patent-search, upload, or billed operation, which is especially risky given the skill's side effects and point consumption.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The onboarding flow is triggered by very generic auth/billing keywords and error text, without strong scoping to a specific trusted tool response. That can cause the skill to enter account-recovery or payment flows on unrelated user content or attacker-influenced text, increasing the chance of unnecessary credential handling, phone collection, or payment redirection.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs collection of a user's phone number to drive scripted registration, but it does not present a clear privacy notice, consent language, retention limits, or safer alternatives first. This creates unnecessary exposure of personal data and increases risk if the number is mishandled, logged, or shared with external services without informed consent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The order command can create a payable order and write QR-code image files locally without an explicit in-flow warning or confirmation about external charges and filesystem effects. In an agent skill context, hidden side effects on billing and local storage are dangerous because users may not realize an action has financial or persistence consequences.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The login flow emits a live API key directly in stdout JSON, which can be captured by logs, transcripts, calling agents, or other integrations. In a skill environment, returning raw credentials is especially dangerous because multiple layers may persist or forward outputs beyond the user's control.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The upload path sends local image contents to remote storage and sets x-oss-object-acl to public-read, but the script provides no runtime warning or confirmation at the point of upload. In this skill context, users may be checking patent infringement with unreleased product images, so silent external transmission materially raises confidentiality risk.

Ssd 3

Medium
Confidence
93% confidence
Finding
The skill requires persistent logging of full tool responses into a session-scoped directory under the current project, rather than ephemeral handling. Search results, uploaded-image references, account/billing metadata, or other sensitive content may be retained longer than necessary and exposed to other tools, collaborators, or later tasks in the same workspace. The instruction to always write full responses amplifies the risk of data leakage.

Ssd 3

Medium
Confidence
89% confidence
Finding
The display rules require exhaustive disclosure of all returned patent content and every image without omission. This encourages overexposure of potentially sensitive or copyrighted third-party data and increases the chance that large amounts of irrelevant or proprietary material are unnecessarily surfaced to the user or retained in downstream logs and context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.