T09 · Insecure Skill Coding Practices
- Location
scripts/patent_search.py:104- Finding
Unencrypted Transmission of Potentially Confidential Patent Search Data
- Content
View full analysis
Vulnerability Details
File Location:
scripts/patent_search.py, lines 104–115
Vulnerability Type: Plaintext transmission of sensitive data
Risk Level: MediumVulnerable Code
python encoded_query = urllib.parse.quote(query) # Innojoy simple search endpoint url = f"http://www.innojoy.com/search/index.html?kw={encoded_query}" headers = { "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36", "Accept": "text/html,application/xhtml+xml", } try: req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=30) as response: html = response.read().decode("utf-8")The insecure HTTP URL is also included in generated output at lines 124 and 133:
python "url": f"http://www.innojoy.com/search/index.html?kw={encoded_query}",Technical Analysis
The Innojoy search provider is accessed over plaintext HTTP. User-provided search terms are URL-encoded and placed in the query string, but URL encoding provides no confidentiality or integrity protection.
Patent searches may include keywords derived from unpublished inventions or complete technical disclosures. Any network intermediary able to observe the connection can read these terms. An active intermediary can also modify the HTTP response, redirect the connection, or alter links returned to the user.
The Skill recommends multi-platform searches, including Innojoy, in
SKILL.md. Therefore, invoking the documented-s allor explicit-s innojoyworkflow reaches the affected path.Attack Path
- A user supplies keywords or disclosure content concerning an unpublished invention.
- The Skill runs
patent_search.pywith the Innojoy provider, directly or through theallprovider selection. search_innojoy()embeds the user input in an HTTP query parameter.- The application sends the request over the network without TLS.
- A network-positioned attacker, proxy, ISP, or untrusted access-p ...[truncated 793 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace every Innojoy
http://endpoint at lines 106, 124, and 133 with a verifiedhttps://endpoint. - Confirm that TLS certificate validation remains enabled; do not introduce an unverified SSL context or suppress certificate errors.
- If Innojoy does not provide a functional HTTPS endpoint, disable this provider rather than transmitting patent information over plaintext HTTP.
- Obtain explicit user consent before submitting invention-related content to third-party services, particularly when the
allprovider option is selected. - Minimize transmitted data by sending narrowly scoped keywords instead of complete disclosure text.
- Avoid placing sensitive input in URLs where it may be retained in browser history, proxy logs, or server access logs. Use a documented HTTPS POST API where the provider supports one.
- Add automated tests or static checks that reject plaintext HTTP endpoints in network-enabled provider implementations.
- Document which third parties receive search data and warn users not to submit confidential details unless disclosure is authorized.
- Replace every Innojoy