Security audit

patent-management-system

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed patent-management system builder that retrieves patent records through a configured PatSnap/智慧芽 MCP service and writes a local HTML dashboard.

Install only if you intend to use PatSnap/智慧芽 MCP access for patent-management workflows. Confirm the target company and whether you want read-only analysis or local HTML updates before running data-sync prompts, especially in enterprise IP contexts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The data-update trigger phrase is very broad and resembles normal user requests, so the skill may activate in situations where a user only intended a general patent-data question or summary. In this skill’s context, unintended activation can cause retrieval of real company patent records and overwrite or update local HTML system files, creating privacy, integrity, and consent problems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to pull real company patent data and generate or update a local system, but it does not require a clear notice about what data will be retrieved, stored, or written locally. In an enterprise IP context, this increases the risk of handling sensitive business information without informed user consent, proper scoping, or data-minimization controls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.