Security audit

patent-research-analyst

Security checks across malware telemetry and agentic risk

Overview

This patent-analysis skill is purpose-aligned and disclosed, with user confirmation before patent searches and no hidden persistence or executable install behavior.

Before installing, make sure you are comfortable sending the technical problem, proposed technical solution, and competitor names to the configured PatSnap/Zhihuiya MCP service. Treat generated FTO or infringement conclusions as research support, not legal advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list includes broad natural-language phrases such as '帮我做专利检索', which can match ordinary user requests without strong scoping constraints. This creates an unintended activation risk where the skill may engage in contexts the user did not explicitly intend, potentially causing unnecessary tool use, data processing, or generation of authoritative-seeming legal/patent analysis.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The activation section defines broad intents like '帮我分析这个技术方向的专利' without clear boundaries on required inputs, user role, or task scope. In this skill context, accidental activation is more concerning because the workflow drives multi-step patent retrieval and risk analysis, which can consume sensitive inputs and produce consequential FTO-style conclusions if invoked too loosely.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.