The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided inputs including lamp drawings, product images, bill of materials, and design briefs to generate automotive component breakdowns and patent risk assessments. This ingestion surface is vulnerable to indirect prompt injection where malicious instructions embedded in the design data could influence the agent's behavior. Mandatory Evidence: (1) Ingestion points: Product images, drawings, and design briefs defined in the 'Required inputs' section of SKILL.md. (2) Boundary markers: Absent; there are no explicit delimiters or instructions to ignore embedded commands in user data. (3) Capability inventory: File system writing (.html and .zip) and network-enabled MCP tool invocation. (4) Sanitization: No explicit instructions to sanitize or escape user-provided strings before they are interpolated into the final report.
[DYNAMIC_EXECUTION]: The skill is instructed to generate a self-contained HTML5 file featuring inline CSS and JavaScript to provide a tabbed user interface. This represents a dynamic execution vector; if user-provided content (such as component names or descriptions) is not sanitized during report generation, it could lead to Cross-Site Scripting (XSS) when the resulting report is opened in a browser.
[EXTERNAL_DOWNLOADS]: The skill references several external MCP (Model Context Protocol) servers hosted by the author organization, Patsnap (e.g., patsnap_patent_research, patent_briefing). These are official vendor resources used for patent and IP searching. While they represent external connections, they are considered safe as they originate from the verified vendor infrastructure and align with the skill's stated automotive IP assessment purpose.

assess-automotive-lighting-ip