patent-search

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly asks the user to paste their Patsnap API Key into chat and shows HTTP examples that embed that key (in the query string and Authorization header), which requires the LLM to accept and include secret values verbatim in requests/output, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path ingests outsider-authored free text at Step 1 (user input) and uses it to construct the Patsnap MCP query (Step 2: ?query=/other params), then the MCP response is processed and returned.