ClawHub
Back to skill

Security audit

monitor-competitor-patent-landscape-ip

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed patent-landscape workflow that uses PatSnap services and local report generation for its stated purpose.

Before installing, confirm you are comfortable sending competitor, technology scope, search terms, and retrieved patent-analysis data to PatSnap MCP services, and choose report output paths intentionally. Treat the generated report as research support, not legal advice or FTO clearance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill instructs use of networked MCP services and a report generator that writes output files, but the skill declares no permissions or trust boundary for those capabilities. This creates a transparency and governance gap: operators may approve or run the skill without understanding that it can exfiltrate user-supplied research inputs to external services and write artifacts locally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The skill promises substantive patent-search, claim-review, and strategic-analysis capabilities, but the available behavior appears to be report rendering of supplied data rather than performing the claimed analysis. In a legal-adjacent IP workflow, this can mislead users into trusting unsupported conclusions, omit critical validation steps, and produce decision-grade outputs that appear evidence-backed when they are not.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.