create-patent-search-report-ip
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, primarily from
tagged_pool.csvand other upstream stage artifacts (SKILL.md). This ingestion surface is addressed through mandatory instructions that require the agent to escape all retrieved content and explicitly prevent HTML, script, and spreadsheet formula injection in the generated report. - [EXTERNAL_DOWNLOADS]: The documentation references external URLs for Patsnap MCP servers (README.md, SKILL.md). These resources belong to the authoring organization (patsnap) and are provided for tool discovery and documentation purposes rather than runtime remote code execution.
- [DATA_EXFILTRATION]: The skill instructions include clear security boundaries for the
report_manifest.jsonoutput, explicitly stating that no secrets, API keys, or absolute user paths should be included in the manifest (SKILL.md). This demonstrates proactive management of sensitive data handling.
Audit Metadata