tm-search
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches trademark registration data from the external USPTO database, which is an untrusted source that could contain embedded instructions.\n
- Ingestion points: Data is ingested through the
tm_search.pyscript usingrequestsfor the TSDR API and Playwright for browser-based keyword search.\n - Boundary markers: The skill does not implement delimiters or specific instructions to prevent the agent from following directives that might be found within trademark mark text or status fields.\n
- Capability inventory: The skill is limited to performing network searches to specified trademark APIs and outputting results to the console or CSV files; it does not have access to dangerous system calls or arbitrary command execution.\n
- Sanitization: Data retrieved from external APIs is parsed and displayed without validation or escaping for prompt injection strings.
Audit Metadata