free-patent-search-zhcn

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks the user to paste their Patsnap API Key into the conversation and includes example requests that embed the key verbatim (apikey query param and Authorization: Bearer header), which requires the LLM to receive and emit secret values.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Runtime path: the skill takes outsider-authored free text (user input keywords/technical description/intent parameters) and sends it directly as query/applicant/ip/year filters in a GET request to https://connect.patsnap.com/f8fb98/mcp?...&query=..., where the MCP then returns patent fields (title/applicant/legal_status/etc.).