ClawHub
Back to skill

Security audit

patent-mining-agent

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent patent-mining assistant, but it requires sensitive project confirmation details to be retained and reproduced verbatim in final reports without a redaction or consent control.

Review this skill carefully before installing. It may be useful for patent-mining workflows, but avoid entering secrets, unreleased invention details, sensitive company strategy, personal data, or confidential competitor assessments unless you are comfortable with those details being copied verbatim into generated reports and potentially used in external patent or web search tools.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Ssd 3

High
Confidence
97% confidence
Finding
This instruction requires the final report to reproduce all information confirmed at CP-0, including any user-added details, '原样写入' without omission. That creates a data-minimization and privacy risk: users may provide sensitive business, personal, or competitive information during confirmation, and the agent is compelled to persist and echo it verbatim into generated artifacts where it may be retained, shared, or exported.

Ssd 3

High
Confidence
99% confidence
Finding
The skill explicitly instructs the agent to record the user's entire confirmation reply and preserve all extra information '原文引用，不得概括'. This is dangerous because it forces collection and retention of potentially unnecessary sensitive content, increasing the chance of confidential data leakage into downstream reports, logs, tool calls, or shared work products.

Ssd 3

High
Confidence
99% confidence
Finding
The mandatory project overview requires verbatim inclusion of all user supplemental information and even forbids summarization or omission. In the context of patent mining for enterprises, users are likely to share highly sensitive R&D strategy, company background, competitor assessments, and other confidential details, so hard-coding verbatim reproduction materially raises disclosure risk if reports are circulated or stored.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.