competitor-skill

• Outcome: Review
• Latest audit: Aug 13, 2026 · 8:19 AM UTC
• Version: 1.0.0

Overview

The skill mostly generates patent reports, but it also persists API keys and automatically performs broader literature, AI, package-install, and credential-loading behavior that users should review first.

Review before installing. Use a scoped PatSnap key, avoid pasting production secrets into chat if platform secret storage is available, and check or remove the cross-project .env fallback. Expect automatic network calls to PatSnap literature APIs and possibly ARK if configured, local report/image persistence, and automatic dependency installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (21)

Tainted flow: 'fig_url' from requests.get (line 164, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

if images_dir:
                        # 下载图片到本地
                        try:
                            img_resp = requests.get(fig_url, timeout=15)
                            img_resp.raise_for_status()
                            ext = fig_url.split("?")[0].rsplit(".", 1)[-1] or "jpg"
                            local_path = images_dir / f"{pid}.{ext}"

• Confidence: 97% confidence
• Finding: The code fetches fig_url directly from API response data and then performs requests.get(fig_url) without validating the scheme, host, or IP range. If the upstream service is compromised or returns attacker-controlled URLs, this creates an SSRF primitive that can probe internal services, access cloud metadata endpoints, or trigger unintended outbound requests from the host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while its documented behavior requires reading environment/config files, writing reports and a `.env` file, and making network requests to external services. This undermines least-privilege expectations and can cause users or the host agent to authorize capabilities they were not clearly warned about.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose is patent-search report generation, but the finding indicates additional behaviors such as literature-database searches, calls to another model API, local image downloads, and HTML rendering. Hidden or under-disclosed behavior increases data exposure risk because user queries and retrieved content may be sent to extra third parties or persisted locally in ways the user did not anticipate.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to collect the user's PatSnap API key via chat and persist it into a local `.env` file. Collecting secrets in conversational flow and storing them locally creates unnecessary secret-handling risk, especially if the workspace is shared, logged, synced, or later exposed to other tools.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The documentation presents two conflicting trust and authentication models: direct API-key storage in `.env` and separate MCP-based authorization. This ambiguity can lead users to choose the less secure path or misunderstand where credentials are stored and which service actually receives their data.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill is described as generating competitor patent analysis from patent-database queries, but this report embeds a large journal-literature analysis section with 1455 hits and AI summarization. That scope expansion increases data access and output surface beyond the declared purpose, which can expose users to undisclosed collection, processing, and presentation of unrelated external content.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The output exposes external literature-search capability through DOI and Google Scholar links, plus an AI-generated literature summary, despite the stated purpose being patent-database competitor analysis. This creates an undeclared outbound-navigation and data-sourcing path that can mislead users about what systems are being queried and what third-party content is incorporated.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as generating competitor patent analysis from a patent database, but the report also performs broad journal-literature retrieval and AI summarization unrelated to the stated patent-only scope. This scope expansion can cause unauthorized or unexpected data access/processing, weaken user trust boundaries, and create opportunities for prompt drift or misuse beyond the declared capability.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The output demonstrates non-patent literature retrieval and summarization capability that is not justified by the skill’s stated purpose. Undeclared capability expansion is dangerous because it changes the effective data-access surface and may lead users or operators to expose the skill to content sources, policies, or compliance obligations they did not authorize.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The file expands the skill from patent-query analysis into journal literature retrieval and downstream report generation, which is broader than the declared manifest scope. This matters because users and reviewers may not expect additional data collection, external API use, and processing paths, increasing the chance of undisclosed data handling and permission creep.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code sends retrieved literature titles and abstracts to a separate ARK AI service that is not described in the manifest. Undisclosed third-party transmission is dangerous because it can expose retrieved content and user-derived research context to another processor without informed consent or governance review.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script will automatically install Python packages at runtime if imports fail, which expands its behavior beyond merely generating a patent report. This introduces supply-chain and environment-modification risk because execution now depends on fetching and installing code from package indexes without explicit user approval or pinning.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly asks for a user's API key and directs saving it to a `.env` file without a privacy, retention, or access warning. This is dangerous because users may disclose production credentials without understanding that they will be persisted on disk and potentially accessible to other local processes or future sessions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The summarization routine composes a prompt from literature titles and abstracts and transmits it to an external AI API without any visible user warning or consent check. In a competitive-intelligence workflow, even public literature selections can reveal sensitive user interests, search strategy, or ongoing R&D focus when forwarded to a separate provider.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script performs package installation and then executes Python code without a prior explicit warning or confirmation step. This is dangerous because users may not expect network access, dependency resolution, or local environment changes when invoking a reporting skill, increasing supply-chain and trust-boundary risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill tells the agent to solicit a secret from the user and write it into a local configuration file. In the context of an agent skill, this is especially risky because chat content may be logged and the resulting file may persist beyond the session, broadening the attack surface for credential theft or accidental disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""

    try:
        resp = requests.post(
            f"{_cfg.ARK_BASE_URL}/chat/completions",
            headers={
                "Authorization": f"Bearer {_cfg.ARK_API_KEY}",

• Confidence: 93% confidence
• Finding: This request posts constructed prompt content to an external ARK endpoint, creating a concrete outbound data transmission path. In this skill context, the transmitted content aggregates literature results tied to a patent search theme, which can leak competitive-analysis intent and research focus to an external service if not transparently disclosed and controlled.

Credential Access

High

• Category: Privilege Escalation

Content

# 优先加载本目录的 .env，其次加载 patsnap_skill 的 .env（共享凭证）
_here = Path(__file__).parent
for _env in [_here / ".env", _here.parent / ".env", Path.home() / "Documents" / "patsnap_skill" / ".env", Path.home() / "Documents" / "patsnap_skill" / "scripts" / ".env"]:
    if _env.exists():
        load_dotenv(_env)
        break

• Confidence: 84% confidence
• Finding: The code searches multiple filesystem locations, including another skill directory under the user's Documents folder, and automatically loads the first .env file found. This broad, cross-project credential loading can unintentionally import secrets from an unrelated context or allow credential substitution if a less-trusted local file is present, increasing the chance of secret misuse or sending requests under the wrong account.

Credential Access

High

• Category: Privilege Escalation

Content

# 优先加载本目录的 .env，其次加载 patsnap_skill 的 .env（共享凭证）
_here = Path(__file__).parent
for _env in [_here / ".env", _here.parent / ".env", Path.home() / "Documents" / "patsnap_skill" / ".env", Path.home() / "Documents" / "patsnap_skill" / "scripts" / ".env"]:
    if _env.exists():
        load_dotenv(_env)
        break

• Confidence: 84% confidence
• Finding: The code searches multiple filesystem locations, including another skill directory under the user's Documents folder, and automatically loads the first .env file found. This broad, cross-project credential loading can unintentionally import secrets from an unrelated context or allow credential substitution if a less-trusted local file is present, increasing the chance of secret misuse or sending requests under the wrong account.

Credential Access

High

• Category: Privilege Escalation

Content

# 优先加载本目录的 .env，其次加载 patsnap_skill 的 .env（共享凭证）
_here = Path(__file__).parent
for _env in [_here / ".env", _here.parent / ".env", Path.home() / "Documents" / "patsnap_skill" / ".env", Path.home() / "Documents" / "patsnap_skill" / "scripts" / ".env"]:
    if _env.exists():
        load_dotenv(_env)
        break

• Confidence: 84% confidence
• Finding: The code searches multiple filesystem locations, including another skill directory under the user's Documents folder, and automatically loads the first .env file found. This broad, cross-project credential loading can unintentionally import secrets from an unrelated context or allow credential substitution if a less-trusted local file is present, increasing the chance of secret misuse or sending requests under the wrong account.

Credential Access

High

• Category: Privilege Escalation

Content

# 优先加载本目录的 .env，其次加载 patsnap_skill 的 .env（共享凭证）
_here = Path(__file__).parent
for _env in [_here / ".env", _here.parent / ".env", Path.home() / "Documents" / "patsnap_skill" / ".env", Path.home() / "Documents" / "patsnap_skill" / "scripts" / ".env"]:
    if _env.exists():
        load_dotenv(_env)
        break

• Confidence: 84% confidence
• Finding: The code searches multiple filesystem locations, including another skill directory under the user's Documents folder, and automatically loads the first .env file found. This broad, cross-project credential loading can unintentionally import secrets from an unrelated context or allow credential substitution if a less-trusted local file is present, increasing the chance of secret misuse or sending requests under the wrong account.

Static analysis

No suspicious patterns detected.