ClawHub
Back to skill

Security audit

build-patent-asset-dashboard-ip

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PatSnap API workflow that uses an API key and PatSnap HTTPS endpoints to build patent dashboard data, with no hidden persistence or unrelated behavior found.

Before installing, confirm you are comfortable giving the skill access to a PatSnap Open Platform API key and allowing requests to PatSnap endpoints. Use a scoped key where possible, avoid embedding the key in files, and recheck endpoint availability because the artifact notes that some global endpoints require verification.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill explicitly instructs the agent to read an API key from an environment variable and make outbound HTTPS requests, but it declares no permissions. That mismatch can bypass platform trust signals and prevent users or runtime policy from understanding that the skill can access secrets and external networks.

Static analysis

No suspicious patterns detected.