linkfox-zhihuiya-patent-cited

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [PERSISTENCE]: The references/onboarding.md file provides instructions to store the LINKFOX_AGENT_API_KEY in shell configuration files such as ~/.zshrc or ~/.bashrc. This is a standard developer practice for persisting environment variables required for API authentication and does not represent a malicious persistence mechanism.
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches patent citation data from the external PatSnap service, which acts as a potential ingestion point for untrusted data that could influence the agent's behavior.
  • Ingestion points: Data is fetched from the /zhihuiya/patentCited API endpoint and processed in scripts/zhihuiya_cited_by.py.
  • Boundary markers: No explicit delimiters or boundary markers are used in the processing scripts to isolate external patent data from instructions.
  • Capability inventory: The skill has capabilities to write logs and JSON response data to the local linkfox/ directory and perform network requests to LinkFox API domains.
  • Sanitization: The skill does not perform explicit sanitization of the patent citation strings before they are returned to the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 06:51 AM