ClawHub
Back to skill

Security audit

PatentFig AI Patent Drawing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PatentFig AI API helper for patent drawing generation and conversion, with no hidden execution or unrelated data access found.

Before installing, confirm you are comfortable sending patent prompts, drawings, and related invention details to PatentFig AI, especially for confidential, pre-filing, client, or export-controlled material. Pin or review install sources if your environment requires reproducible supply-chain controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README advertises prompt-based image generation and image/vector conversion through the PatentFig AI API but does not clearly warn that user prompts, uploaded drawings, and possibly sensitive invention materials will be transmitted to a third-party service. In the patent context, this is more dangerous because pre-filing invention disclosures, draft figures, and technical diagrams may be confidential, legally sensitive, or subject to organizational IP-handling restrictions.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium
Category
Data Exfiltration
Content
Verify connectivity and credit balance (free call):

```bash
curl -s https://patentfig.ai/api/v1/credits \
  -H "Authorization: Bearer $PATENTFIG_API_KEY"
# → { "success": true, "data": { "balance": 500 } }
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.