ecommerce-patent-fulltext-images
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the Nexscope proxy base URL defined in the
NEXSCOPE_PROXY_BASEenvironment variable to fetch patent image metadata from the Zhihuiya service. These operations are essential for the skill's primary functionality and target vendor-controlled infrastructure. - [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/patent_fulltext_images.py) to perform API requests and manage data. The script uses standard libraries and does not invoke shells or execute untrusted code. - [INDIRECT_PROMPT_INJECTION]: The skill processes patent metadata (image paths and types) returned from an external API. While this data is interpolated into the agent's response as clickable links, the risk is mitigated by the fact that the data originates from a structured patent database via a controlled proxy.
- Ingestion points: API response data processed in
scripts/patent_fulltext_images.pyand returned to the agent. - Boundary markers: None explicitly defined for the external data.
- Capability inventory: Local file writing, stdout printing, and network requests via
urllib. - Sanitization: The script parses JSON and validates that parameters are strings, but does not perform content-based sanitization of the API response before display.
Audit Metadata