中国生物医药专利撰写（CN Biopharma Patent Drafting）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:59 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for CNIPA biopharma patent drafting, but it can automatically send highly confidential invention materials to multiple external patent/OCR/drafting services without a clear consent gate.

Install only if you are comfortable using PatSnap/Zhihuiya cloud and MCP services with unpublished patent material. Before use, ask the agent to confirm every external transmission, prefer environment variables over command-line API keys, avoid placing full disclosures or secrets in shell arguments, and use local/manual OCR or redacted excerpts when confidentiality matters.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Error

• Location: SKILL.md:47

Finding

Cloud OCR Uploads Confidential Local Documents Without an Explicit Consent Gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-57
Vulnerability Type: Unconsented Sensitive Data Transmission
Risk Level: High

Vulnerable Code Snippet

bash

python "$USERPROFILE/.workbuddy/api-wrappers/ai60/cli.py" smart_doc --file /path/to/document.pdf [-o output.md]
python "$USERPROFILE/.workbuddy/api-wrappers/ai60/cli.py" smart_doc --document "https://..." [-o output.md]

The corresponding capability map identifies AI60 as a cloud OCR service hosted at https://connect.zhihuiya.com. File mode uploads the supplied document and requires an API key with upload permission.

Technical Analysis

The workflow instructs the agent to use AI60 cloud OCR first when an input is a sketch, image, or scanned PDF. Patent-drafting inputs commonly contain unpublished inventions, chemical structures, biological sequences, inventor information, and other commercially sensitive material.

The Skill does not require the agent to obtain explicit, informed approval before uploading a local file. It also does not require disclosure of the destination, retention policy, jurisdiction, or exact data scope. This exceeds minimum privilege because references/source-map.md, lines 29-35, documents a local RapidOCR fallback. A local processing path therefore exists and could be used as the privacy-preserving default.

Attack Path

1. A user supplies a confidential scanned patent disclosure or laboratory document.
2. The Skill classifies it as scanned or image-based input.
3. The agent follows the first-choice OCR instruction and invokes AI60 in file mode.
4. The wrapper uploads the entire local document to the PatSnap cloud service.
5. Confidential document content and associated metadata leave the local environment without a dedicated confirmation step.

Impact Assessment

The behavior can disclose the complete contents of selected user files to an external processor. The affected scope may include u ...[truncated 498 chars]

Remediation

View remediation

Remediation Suggestions

1. Make local OCR the default for all local files.
2. Before any cloud upload, request explicit user approval and state:
   • the service provider and destination;
   • whether the complete file will be uploaded;
   • the categories of potentially sensitive information;
   • available local-only alternatives;
   • any known retention, logging, and data-residency terms.
3. Add a mandatory local-only mode that prevents file upload and external URL submission.
4. Minimize data before transmission by removing metadata, unrelated pages, personal identifiers, and hidden document content.
5. Require the user to select the specific files and pages authorized for upload.
6. Record consent without recording file contents or credentials.
7. Fail closed when consent is absent rather than silently selecting cloud OCR.
8. Document deletion and retention controls for uploaded documents.

other

Error

• Location: SKILL.md:63

Finding

Mandatory Novelty Analysis and Optional Drafting APIs Disclose Confidential Invention Content to Multiple External Services

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-70 and 110-129
Vulnerability Type: Excessive External Data Disclosure
Risk Level: High

Vulnerable Code Snippet

bash

node "$USERPROFILE/.workbuddy/api-wrappers/ai32/cli.mjs" create_and_wait --tech_solution "..." --output disclosure.docx

bash

python "$USERPROFILE/.workbuddy/api-wrappers/ai37/cli.py" run_full_flow --claim "..." --disclosure "..." [--title "..." ] [--api-key SK]

The same workflow requires the normalized technical solution to be submitted through novelty_lite_submit and polled with novelty_lite_get before claims are drafted.

Technical Analysis

The Skill directs the agent to transmit several forms of patent-sensitive information:

• the normalized technical solution to the novelty-analysis service;
• the technical solution to AI32 for disclosure generation;
• claims and the complete disclosure to AI37 for specification generation;
• potentially structures, sequences, targets, diseases, and clinical information to conditional MCP services.

External processing is related to the declared patent-search and drafting functionality. However, the workflow does not establish per-service consent, data minimization, redaction, retention controls, or a clear inventory of recipients. Channel A novelty analysis is declared mandatory, so a user cannot follow the normal workflow without transmitting the technical solution externally.

The Skill provides orchestration-layer fallbacks for AI32 and AI37, demonstrating that those transmissions are not strictly necessary for drafting. The absence of equivalent privacy controls for mandatory novelty analysis creates a disproportionate confidentiality risk.

Attack Path

1. A user submits an unpublished invention disclosure.
2. The agent normalizes the supplied material into a detailed tech_solution.
3. The workflow requires the complete technical solution to be submit ...[truncated 1173 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit opt-in separately for novelty search, AI32 generation, AI37 generation, and each conditional intelligence service.
2. Present a data-flow summary identifying each recipient and the exact fields to be transmitted.
3. Offer a fully local drafting path and clearly explain that local-only output cannot claim externally verified novelty.
4. Send only the minimum features required for each operation rather than the complete disclosure.
5. Redact inventor names, applicant names, internal project identifiers, unpublished test data, and unrelated implementation details unless required.
6. Support pseudonymous matter identifiers and client-side preprocessing.
7. Establish and document service retention, deletion, encryption, access-control, and data-residency requirements.
8. Prevent automatic expansion into optional channels unless the user has approved both the service and the relevant data category.
9. Include an execution preview showing all intended network transmissions before they occur.

T09 · Insecure Skill Coding Practices

Error

• Location: references/source-map.md:27

Finding

Credentials and Untrusted Patent Content Are Passed Through Shell Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/source-map.md, lines 27-31, 43-49, and 60-68
Vulnerability Type: Insecure Command Construction and Sensitive Argument Exposure
Risk Level: High

Vulnerable Code Snippet

bash

python "$USERPROFILE/.workbuddy/api-wrappers/ai60/cli.py" smart_doc --document "https://example.com/doc.pdf" -o output.md [--api-key KEY]
python "$USERPROFILE/.workbuddy/api-wrappers/ai60/cli.py" smart_doc --file /path/to/document.pdf -o output.md [--api-key KEY] [--no-fallback]

bash

node "$USERPROFILE/.workbuddy/api-wrappers/ai32/cli.mjs" create_and_wait --tech_solution "..." [--api-key KEY] [--language cn] [--output disclosure.docx]
node "$USERPROFILE/.workbuddy/api-wrappers/ai32/cli.mjs" extract_tech_means --tech_solution "..." [--api-key KEY]

bash

python "$USERPROFILE/.workbuddy/api-wrappers/ai37/cli.py" run_full_flow --claim "..." --disclosure "..." [--api-key SK] [--title "..."]
python "$USERPROFILE/.workbuddy/api-wrappers/ai37/cli.py" init_summary --claim "..." --disclosure "..." [--api-key SK]

Technical Analysis

The documented invocation model places API credentials and confidential patent text directly in command-line arguments. Command-line values may be visible through process inspection, command telemetry, diagnostic output, shell history, audit logs, crash reports, or orchestration logs.

In addition, tech_solution, claim, disclosure, document URLs, titles, and paths originate wholly or partly from user-controlled content. If an agent builds a Bash command by textual interpolation instead of invoking the executable with a structured argument array, shell metacharacters, substitutions, quotes, or newlines in those values may alter the command.

For example, a malicious disclosure could contain quote characters followed by shell syntax. If inserted into a shell command without robust escaping, the value could terminate its argument and in ...[truncated 2042 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all examples and recommendations that pass API keys through command-line arguments.
2. Supply credentials through protected environment variables, operating-system secret stores, or inherited private file descriptors.
3. Pass long or sensitive patent content through standard input or permission-restricted temporary files instead of command-line arguments.
4. Invoke wrappers with a structured argument array and with shell parsing disabled.
5. Never concatenate user-controlled text into a Bash command string.
6. If temporary files are required:
   • create them with owner-only permissions;
   • use unpredictable names;
   • avoid shared writable directories;
   • delete them reliably after execution;
   • prevent their contents from entering logs.
7. Validate file paths, URLs, output paths, titles, job identifiers, and language values against strict schemas.
8. Ensure wrapper errors redact credentials and sensitive input.
9. Disable command echoing and prevent execution telemetry from recording argument values.
10. Use separate, narrowly scoped credentials for OCR, disclosure generation, and specification generation rather than one shared bearer token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and heading specify CNIPA-style patent drafting in Chinese context as the required output mode, and the instructions continue in Chinese without indicating any user opt-in or alternative locale. This is a natural-language locale constraint that appears mandatory rather than optional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly instructs sending patent documents, technical solutions, claims, and disclosures to cloud/API tools and local wrappers backed by remote services, but it does not require a user-facing warning, consent step, or data-classification check before transfer. In this skill context, the content is likely highly sensitive pre-filing intellectual property, so silent transmission to external services creates confidentiality, trade-secret, and regulatory/compliance risk even if the functionality is operationally intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.