patent-quality-review-pro

• Outcome: Pass
• Latest audit: Aug 13, 2026 · 9:35 AM UTC
• Version: 1.0.0

Overview

This is a disclosed patent-review report generator with a minor, documented convenience behavior that opens the output folder after creating the Word file.

Before installing, be comfortable with the skill processing sensitive patent application materials, installing python-docx if needed, using the authorized patent MCP service for live data, and writing reports to the chosen output directory. Use a local workspace output path and pass --no-open-output if you do not want the agent to open the output folder automatically.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

open_output_dir["attempted"] = True
    open_output_dir["command"] = "open"
    try:
        open_result = subprocess.run(
            ["open", output_dir_path],
            check=False,
            capture_output=True,

• Confidence: 98% confidence
• Finding: open_result = subprocess.run( ["open", output_dir_path], check=False, capture_output=True, text=True, timeout=10, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

open_output_dir["attempted"] = True
    open_output_dir["command"] = "xdg-open"
    try:
        open_result = subprocess.run(
            ["xdg-open", output_dir_path],
            check=False,
            capture_output=True,

• Confidence: 98% confidence
• Finding: open_result = subprocess.run( ["xdg-open", output_dir_path], check=False, capture_output=True, text=True, timeout=10, )

Tainted flow: 'output_dir_path' from os.environ.get (line 833, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

open_output_dir["attempted"] = True
    open_output_dir["command"] = "open"
    try:
        open_result = subprocess.run(
            ["open", output_dir_path],
            check=False,
            capture_output=True,

• Confidence: 97% confidence
• Finding: open_result = subprocess.run( ["open", output_dir_path], check=False, capture_output=True, text=True, timeout=10, )

Tainted flow: 'output_dir_path' from os.environ.get (line 833, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

open_output_dir["attempted"] = True
    open_output_dir["command"] = "xdg-open"
    try:
        open_result = subprocess.run(
            ["xdg-open", output_dir_path],
            check=False,
            capture_output=True,

• Confidence: 97% confidence
• Finding: open_result = subprocess.run( ["xdg-open", output_dir_path], check=False, capture_output=True, text=True, timeout=10, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and documents capabilities that require environment access, file read/write, and shell execution, yet no permissions are declared. This creates a transparency and policy-enforcement gap: users and the platform cannot accurately assess or constrain what the skill may do, especially since the documented workflow includes dependency installation, file generation, and opening local directories.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill description materially overstates what the tool does while omitting additional behaviors such as evidence-chain auditing, runtime/session file inspection, manifest/error file generation, and attempts to open output paths. This mismatch is dangerous because users may provide sensitive patent materials under false assumptions about processing, while the actual behavior can touch more files and system surfaces than disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest shows the skill invoked a local OS command (`open`) to automatically open a directory on the host. That side effect is outside the core review-and-generate function and expands the skill's authority from document generation into local system interaction, which can surprise users and normalize unnecessary command execution. In a broader agent environment, this pattern can become a foothold for unwanted local actions or command abuse if similar behavior is extended to less benign targets.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: Automatically opening the output directory is an undocumented side effect not described by the skill's stated behavior. Even though the observed action is relatively low risk, hidden behaviors reduce user control and transparency, and they can mask broader capability creep in skills that are expected only to analyze files and generate reports.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The script exceeds its declared responsibility by automatically opening a system directory after document generation. In a security review, this kind of hidden capability is dangerous because it introduces local program-launch behavior not necessary for the patent-review task, increasing the attack surface and making abuse of path control materially more harmful.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Importing and using facilities to start local programs is disproportionate to the business need of generating a Word report. In an agent skill, unnecessary program-launch capability is a security smell because it enables host interaction beyond the minimum required permissions and can be combined with controllable paths to produce side effects.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Automatically opening the output directory without a user-facing warning or confirmation is unsafe behavior for an agent-executed script. Even if intended as convenience, it can surprise operators, trigger GUI/network handlers, and obscure the fact that the skill performs a system action beyond file creation.

Unvalidated Output Injection

High

• Category: Output Handling

Content

open_output_dir["attempted"] = True
    open_output_dir["command"] = "open"
    try:
        open_result = subprocess.run(
            ["open", output_dir_path],
            check=False,
            capture_output=True,

• Confidence: 98% confidence
• Finding: subprocess.run( ["open", output_dir_path], check=False, capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

open_output_dir["attempted"] = True
    open_output_dir["command"] = "xdg-open"
    try:
        open_result = subprocess.run(
            ["xdg-open", output_dir_path],
            check=False,
            capture_output=True,

• Confidence: 98% confidence
• Finding: subprocess.run( ["xdg-open", output_dir_path], check=False, capture_output

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.