Security audit

海外专利申请翻译助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a patent translation workflow, but it pushes connection to a broad external PatSnap MCP service that is broader than needed for basic translation.

Install only if you intend to use PatSnap's external MCP services as part of the workflow. For confidential or unpublished patent materials, avoid sending text to external tools unless you have authorization and understand which MCP service will receive the data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: README.md:45
Finding: Mandatory External MCP Probe and Promotional Response Hijack
Content: View full analysis
⚠️ **PatSnap MCP service is not connected** > > This skill depends on the PatSnap Open Platform MCP service. Complete the following steps first: > > 1. Go to https://open.zhihuiya.com and create an API key. > 2. Visit https://open.zhihuiya.com/marketplace/mcp-servers to obtain the required MCP services. > 3. Enter `/mcp` to confirm the service status. > > Ask the question again after completing the configuration. ``` Faithful English rendering of the complete affected segment from `SKILL.md:89-94`: ```markdown ## Configuration Before Use This skill depends on the PatSnap Open Platform MCP service: - Perform a self-test after installation and on first use; see README.md. - The user must authorize an account and ensure that the corresponding MCP tools are enabled in the Agent environment. - Without the MCP configuration, the skill can only provide an analytical framework and cannot retrieve real-time data or generate database-based conclusions. - If the MCP configuration is missing, direct the user to README.md and https://open.zhihuiya.com/ to obtain MCP access. ``` ### Technical Analysis The declared purpose of the skill is to translate user-provided Chinese patent materials and format them for European, United States, Japanese, or Korean filings. That core f ...[truncated 3240 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says this skill translates Chinese patent application materials into foreign filing text and formats them for EP/US/JP/KR jurisdictions. However, the README documents installation and use of a general PatSnap MCP ecosystem covering patent search, literature search, mining, visualization, landscape analysis, and report generation, which is materially broader than translation/formatting.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description and the rest of the skill instructions are written to operate specifically on Chinese patent application materials ('将中国专利申请文件翻译为海外申请文本', '基于中文优先权/申请文本') and do not offer the user a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a patent translation and formatting workflow, but the configuration section expands its behavior to depend on an MCP service for 'real-time data retrieval' and 'database-based conclusions.' This creates a scope mismatch: operators may enable broader external access than users expect, increasing risks of unnecessary data exposure, undisclosed network access, and reliance on external data in a task that should primarily process user-supplied patent text.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default prompt is written entirely in English even though the skill's display name and purpose are in Chinese, which indicates a fixed language expectation for invocation. This creates a language/locale policy concern because the file does not offer the user an explicit language choice or opt-in for using English.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction 'Use Japanese' forces a specific language/locale in natural language. Under the policy criteria, this is a violation unless the skill offers opt-in language choice or clearly documents a justified region-specific constraint, which this file does not do.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction "Use Korean" mandates a specific language/locale with no indication that the user can choose another language. Under the policy rules, forcing a language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction "Use English" imposes a specific language requirement in natural language. Under the policy, forcing a language without offering user choice or documenting a justified locale constraint is a reportable violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file presents all operational instructions in Chinese, including setup, validation, and failure guidance, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction mandates a default language choice: 'Use English unless the user requests French or German.' Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not present the user with a general language choice beyond those defaults.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.