patent-mcp-setup
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs environment checks (Python version, uv/pip presence) and executes installation commands to set up the MCP server in a virtual environment. It also guides the modification of local configuration files (~/.claude/settings.json and ~/.config/opencode/opencode.json) which is necessary for registering the MCP server.
- [DYNAMIC_EXECUTION]: The skill utilizes dynamic module loading in its registry system (
importlib.import_module) to auto-register tool handlers from a predefined list of internal modules. Additionally, it uses Python one-liners for safe JSON manipulation during the configuration phase. - [INDIRECT_PROMPT_INJECTION]: The skill ingests patent data from the KIPRIS Open API and formats it into Markdown tables for the agent. While this represents a potential attack surface for indirect prompt injection from external patent content, it is the primary intended function of the skill and follows standard processing patterns.
- [SAFE_PRACTICE]: The skill emphasizes the use of virtual environments (
uv venvorpython -m venv) to avoid interfering with the system Python environment and includes utility functions to mask sensitive API keys in logs.
Audit Metadata