patent-draft-agent

SUSPICIOUS：技能目的与主要能力基本一致，属于专利文档生成与检索工作流；但其核心检索链路并非直连官方服务，而是通过第三方 MCP/SerpApi 转发 `SERPAPI_API_KEY` 和查询内容，且 `init.sh`/CLI 依赖未在技能中固定或可审计。未见明确恶意、隐蔽执行或越权凭据收集，但存在中等供应链与数据流完整性风险。

No explicit malicious behavior is present in the supplied configuration. It does introduce a moderate supply-chain risk because npx automatically downloads and executes unpinned packages with confirmation disabled, and those packages receive API keys. Pin trusted package versions, use lockfiles or integrity verification where supported, and restrict the credentials' permissions.