competitive-patent-landscape

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external patent data, which is an untrusted input that could theoretically contain instructions designed to influence the agent's report generation process.
  • Ingestion points: The skill fetches patent titles, abstracts, and full-text claims via MCP tools for brands like Kimberly-Clark and Procter & Gamble as outlined in SKILL.md and references/SEARCH_STRATEGY.md.
  • Boundary markers: There are no explicit instructions or delimiters defined to separate the fetched patent content from the report generation instructions, increasing the risk of the agent following instructions embedded within the data.
  • Capability inventory: The skill is authorized to write HTML reports to the @session/output/ directory. It does not possess broader system capabilities like arbitrary command execution or external network access to non-vendor domains.
  • Sanitization: The workflow described in SKILL.md does not mention any sanitization or filtering of the fetched patent text before it is summarized or analyzed.
  • [EXTERNAL_DOWNLOADS]: The skill depends on the Patsnap Open Platform MCP service for data retrieval.
  • Evidence: SKILL.md directs users to open.zhihuiya.com for service configuration and authorization. This is a vendor-owned resource associated with the skill's author ('patsnap') and is a standard requirement for the tool's functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 01:23 AM