competitive-patent-landscape
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external patent data, which is an untrusted input that could theoretically contain instructions designed to influence the agent's report generation process.
- Ingestion points: The skill fetches patent titles, abstracts, and full-text claims via MCP tools for brands like Kimberly-Clark and Procter & Gamble as outlined in
SKILL.mdandreferences/SEARCH_STRATEGY.md. - Boundary markers: There are no explicit instructions or delimiters defined to separate the fetched patent content from the report generation instructions, increasing the risk of the agent following instructions embedded within the data.
- Capability inventory: The skill is authorized to write HTML reports to the
@session/output/directory. It does not possess broader system capabilities like arbitrary command execution or external network access to non-vendor domains. - Sanitization: The workflow described in
SKILL.mddoes not mention any sanitization or filtering of the fetched patent text before it is summarized or analyzed. - [EXTERNAL_DOWNLOADS]: The skill depends on the Patsnap Open Platform MCP service for data retrieval.
- Evidence:
SKILL.mddirects users toopen.zhihuiya.comfor service configuration and authorization. This is a vendor-owned resource associated with the skill's author ('patsnap') and is a standard requirement for the tool's functionality.
Audit Metadata