Security audit

patent-panorama-analysis

Security checks across malware telemetry and agentic risk

Overview

This skill reads user-provided patent spreadsheets, analyzes them locally with a bundled Python script, and generates an editable HTML report, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you want an agent to process patent spreadsheets and create a derived editable HTML report. Confirm before using any PatSnap/Zhihuiya MCP integration with account authorization, especially for confidential patent or competitive-intelligence data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger conditions are broad and lack exclusion boundaries, so the skill may activate on loosely related patent or risk-analysis conversations. In an agent environment, overbroad auto-triggering can cause unintended processing of uploaded files or invocation of external tooling when the user did not clearly request this workflow.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill says it will read uploaded Excel files and generate an HTML report, but it does not clearly warn that file contents will be parsed, transformed, and written into a new output artifact. That weak transparency can lead to users unintentionally exposing sensitive patent or competitive intelligence data to processing they did not fully understand.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.