Security audit

patent-transaction

Security checks across malware telemetry and agentic risk

Overview

This patent marketplace skill matches its stated purpose, but it needs review because it silently installs a Python package at runtime and handles API tokens/data in ways that are not fully disclosed.

Install only if your organization approves sending patent transaction searches and diligence activity to trade.9235.net. Protect TRADE_API_TOKEN carefully, be aware it is placed in request URLs by this client, preinstall or review openpyxl handling before exports, and treat generated export files as business-confidential.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares required environment variables, Python, network access to a remote API, and explicitly supports Excel export, but it does not declare permissions for those capabilities. That mismatch can prevent users or the platform from making an informed trust decision and may allow file creation/network activity to occur without clear disclosure. In this context, the behavior appears aligned with the skill’s stated purpose, so the issue is transparency and control failure rather than obviously malicious behavior.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The code automatically installs openpyxl at runtime via pip or uv, which introduces network-enabled code acquisition and execution into a skill whose core purpose is a patent marketplace workflow. That expands the attack surface by allowing unreviewed dependency retrieval during normal operation, creating supply-chain and environment-integrity risks if package sources, indexes, or local pip configuration are compromised.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The README instructs users to set and use an API token for a third-party patent-trade service but provides no guidance on credential handling, token scope/rotation, or the fact that search and transaction-related queries will be transmitted to an external endpoint. In this context, that omission can lead to accidental token exposure in shells, logs, screenshots, or checked-in config files, and users may unknowingly send sensitive commercial diligence queries to an outside service.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger list includes broad terms such as ‘转让’ and ‘许可’, which can appear in many normal business or legal conversations unrelated to this marketplace skill. Overly generic activation phrases increase the chance of unintended invocation, which could cause unrequested external API calls, data lookups, or file exports in contexts where the user did not intend to use this skill.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The metadata and description advertise Excel export/download capability but do not clearly warn users that the skill will generate or download files. File generation is a materially different action from displaying search results, and without upfront disclosure users may trigger local file writes unexpectedly, which is especially relevant in an agent environment with file-write capability.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill performs package installation silently, without user confirmation or an administrator approval boundary. In environments where this agent runs with broad permissions, that behavior can unexpectedly modify the host, pull code from external repositories, and violate deployment expectations or change-control requirements.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The client appends the API token as a query parameter (`t`) on GET requests. Tokens in URLs are commonly exposed through logs, proxies, browser/history artifacts, monitoring systems, and referrer leakage, so this unnecessarily broadens credential exposure even if HTTPS is used. In this skill context, the token appears to authorize access to the trade API, making disclosure potentially sufficient for unauthorized API use.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: excel_export.py:33

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: main.py:28

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: trade_api.py:33