light-patent

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an architecture for processing technical materials (papers, code, experimental records) to generate patent documents.
  • Ingestion points: User-provided technical documents and a structured case.json configuration file, processed by scripts/audit_case.py and scripts/export_case.py.
  • Boundary markers: The skill instructions in SKILL.md emphasize strict adherence to technical facts and the separation of formal text from work records.
  • Capability inventory: Local file system operations including reading source files, creating workspace directories, and writing Markdown/Word documents.
  • Sanitization: The scripts/audit_case.py file includes a defensive regex check against XXE (XML External Entity) injections when validating OMML (Office Math Markup Language) blocks before parsing them with the standard xml.etree.ElementTree module.
  • [COMMAND_EXECUTION]: The skill includes internal Python scripts for workflow automation. Static analysis flags the use of subprocess.run in the test suite (tests/test_tools.py and tests/test_traceability.py), which is a legitimate and standard practice for testing CLI tools by invoking the Python interpreter.
  • [EXTERNAL_DOWNLOADS]: The skill documentation refers to official Chinese government websites (CNIPA, NCAC) for verifying patent guidelines and software copyright rules. These are well-known and trusted official domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 12:28 AM