korean-patent-search

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md and instruction.md recommend using npx -y @nomadamas/k-skill@0 to fetch and execute updated instructions and helper scripts from the NPM registry.
  • [COMMAND_EXECUTION]: The skill requires the execution of shell commands, specifically npx and python3, to run the patent search logic provided in scripts/patent_search.py.
  • [DATA_EXFILTRATION]: The helper script scripts/patent_search.py transmits the KIPRIS_PLUS_API_KEY (sourced from environment variables or command-line arguments) to the official KIPRIS Plus API endpoint at plus.kipris.or.kr to authenticate requests. This is a functional requirement for the service.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external source (patent abstracts and titles from the KIPRIS API).
  • Ingestion points: External XML data is fetched via urllib.request.urlopen in scripts/patent_search.py.
  • Boundary markers: The script does not implement specific boundary markers or sanitization for natural language instructions that might be embedded in patent text.
  • Capability inventory: The script's capabilities are limited to network reads and printing JSON to standard output; it does not perform file writes or system command execution based on the API response.
  • Sanitization: Basic whitespace cleaning is performed via clean_text, but no content filtering for prompt injection is implemented.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 02:41 PM