ClawHub
Back to skill

Security audit

patent-project-proposal

Security checks across malware telemetry and agentic risk

Overview

This skill is a transparent PatSnap patent-report workflow; its main risks are expected external patent queries and limited-language analysis, not hidden or destructive behavior.

Install only if you are comfortable using PatSnap MCP for patent research. Treat project technical descriptions and company names as potentially confidential before sending them through external patent-search tools, and do not rely on the FTO section as formal legal advice.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger condition activates on broad phrases like '帮我做立项' or '支撑立项报告' without stronger scoping, confirmation, or exclusion logic. This can cause the agent to invoke a powerful multi-step workflow unexpectedly, leading to unintended data collection, external tool use, and generation of authoritative-seeming patent/FTO analysis when the user may have intended a simpler request.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The skill hard-codes `lang="cn"` across many tool calls regardless of user language or jurisdictional needs. In a patent-analysis and FTO context, this can bias retrieval, omit relevant foreign-language results, and produce incomplete or misleading legal-risk conclusions, especially for cross-border searches where language coverage materially affects accuracy.

VirusTotal

42/42 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.