The Agent Skills Directory

[DATA_EXFILTRATION]: The skill securely manages Patsnap API credentials by retrieving them from environment variables or local files, specifically forbidding their inclusion in logs, reports, or query text. It protects the 'Authorization' header by rejecting HTTP redirects during API calls to its primary endpoint (connect.patsnap.com).
[COMMAND_EXECUTION]: An orchestration script (run_all.py) uses subprocess.run to execute the pipeline's internal stages. This is implemented safely using absolute paths to the skill's own distributed Python files and avoids shell execution, preventing command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches patent metadata and optional abstract images from official Patsnap domains. Image downloads in hv_8_word.py include robust security controls such as scheme validation (HTTPS only), redirect rejection, and a strict 8MB size limit to prevent resource exhaustion or exfiltration via redirects.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted patent data (titles, summaries) from external API results. It mitigates potential injection and XSS risks by using strict HTML escaping for all dynamic values in the generated reports (hv_7_html_a.py) and validating URL schemes for all hyperlinks.
Ingestion points: Patent metadata and summaries retrieved in hv_1_fetch.py and hv_5_display.py.
Boundary markers: The generated HTML report uses standard HTML escaping for all data fields to prevent malicious content from influencing the agent or user browser context.
Capability inventory: Orchestrated subprocess calls in run_all.py (limited to internal scripts) and file-write operations across all stages to save checkpoints and final reports.
Sanitization: Comprehensive use of html.escape and URL validation via urlparse to ensure only safe, verified links are rendered in the final output.

assess-high-value-patent-portfolio-ip