skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-zhihuiya-utility-patent-image-search/Gen Agent Trust Hub
ecommerce-zhihuiya-utility-patent-image-search
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform its core operations.
scripts/upload_image.pyhandles the transmission of image data to the Nexscope Asset API using a presigned URL flow.scripts/zhihuiya_utility_patent_image_search.pymanages the search request to the patent database and implements a local caching mechanism within thenexscopesubdirectory of the current working directory. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves and displays extensive patent metadata (including titles, abstracts, and descriptions) from the external Zhihuiya database. This external content could be manipulated to include malicious instructions targeting the agent.
- Ingestion points: Patent records fetched via the
/zhihuiya/patentImageSearchAPI endpoint as described inreferences/api.mdandSKILL.md. - Boundary markers: Absent; the instructions in
SKILL.mddo not specify the use of delimiters or 'ignore' instructions when displaying retrieved patent content. - Capability inventory: The skill possesses the capability to write to the local file system (caching and session data) and to perform network requests to defined API endpoints.
- Sanitization: Absent; no explicit validation or sanitization of the patent text is performed before it is presented to the agent.
Audit Metadata