light-patent
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides an architecture for processing technical materials (papers, code, experimental records) to generate patent documents.
- Ingestion points: User-provided technical documents and a structured
case.jsonconfiguration file, processed byscripts/audit_case.pyandscripts/export_case.py. - Boundary markers: The skill instructions in
SKILL.mdemphasize strict adherence to technical facts and the separation of formal text from work records. - Capability inventory: Local file system operations including reading source files, creating workspace directories, and writing Markdown/Word documents.
- Sanitization: The
scripts/audit_case.pyfile includes a defensive regex check against XXE (XML External Entity) injections when validating OMML (Office Math Markup Language) blocks before parsing them with the standardxml.etree.ElementTreemodule. - [COMMAND_EXECUTION]: The skill includes internal Python scripts for workflow automation. Static analysis flags the use of
subprocess.runin the test suite (tests/test_tools.pyandtests/test_traceability.py), which is a legitimate and standard practice for testing CLI tools by invoking the Python interpreter. - [EXTERNAL_DOWNLOADS]: The skill documentation refers to official Chinese government websites (CNIPA, NCAC) for verifying patent guidelines and software copyright rules. These are well-known and trusted official domains.
Audit Metadata