ClawHub
Back to skill

Security audit

disclosure-completion-assistant

Security checks across malware telemetry and agentic risk

Overview

The skill mainly provides a local patent disclosure form, but its setup instructions push broad external PatSnap MCP/API access that is not declared in the manifest and is under-scoped for sensitive invention data.

Review before installing. Use only with invention details you are authorized to process, avoid trade secrets unless your organization approves the environment, and do not configure the PatSnap MCP/API services unless you actually need them and understand what data may be sent externally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The README materially mismatches the declared skill purpose: instead of documenting a patent disclosure completion assistant, it directs users to connect a broad set of third-party PatSnap MCP services for search, mining, reporting, and literature access. This kind of scope mismatch is dangerous because it can cause users or agents to grant unnecessary external capabilities and route sensitive invention-disclosure data to remote services that were not clearly disclosed as part of the claimed skill behavior.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation instructs users to obtain API keys and connect remote MCP services but provides no guidance on credential handling, least-privilege setup, or the risks of uploading confidential patent or R&D material to a third-party platform. In the context of a patent-disclosure assistant, this is especially sensitive because invention details are often confidential and premature disclosure can harm business interests or patent strategy.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill is designed to collect invention disclosures, R&D notes, and patent-related technical details, which are often highly confidential and commercially sensitive. Failing to warn users about handling sensitive information increases the risk that proprietary material is entered, shared, exported, or processed without appropriate confidentiality, consent, or data-handling controls.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This HTML guide collects highly sensitive patent disclosure content, inventor names, applicant/organization details, prior art references, and protection strategy, then offers AI-assisted rewriting and one-click clipboard export without any visible confidentiality notice, handling warning, or export-risk disclosure. In the patent context, premature or uncontrolled disclosure can harm trade secret protection, create accidental sharing risk, and increase the chance that users paste confidential invention content into unsafe channels.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.