uspto-database
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the
uspto-opendata-pythonlibrary from PyPI to access the Patent Examination Data System (PEDS). - [COMMAND_EXECUTION]: The skill uses Python scripts to interact with USPTO and PatentsView APIs via the
requestslibrary. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves third-party text (abstracts, claims, descriptions) from external APIs, creating a vulnerability surface where malicious instructions in a patent could influence agent behavior.
- Ingestion points: External data is fetched in
scripts/patent_search.py,scripts/peds_client.py, andscripts/trademark_client.py. - Boundary markers: There are no explicit markers or delimiters used to separate retrieved text from agent instructions.
- Capability inventory: The skill enables network access and processes large amounts of external text.
- Sanitization: No sanitization or validation of the retrieved text is performed before it is added to the agent context.
Audit Metadata