The Agent Skills Directory

[SAFE]: The skill implements defensive programming practices. The report generator script (report_generator.py) uses html.escape on all untrusted values before rendering the HTML report, effectively mitigating cross-site scripting (XSS) and injection risks within the generated output.
[SAFE]: File system operations are constrained to user-approved absolute paths. The report_generator_patch.py script validates that output destinations are absolute, identifies as files, and requires explicit user confirmation before overwriting any existing data.
[SAFE]: External tool integration is limited to official Patsnap marketplace connectors. These tools are logically consistent with the skill's stated purpose and the author's identity, representing standard vendor-provided functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (patent disclosures and research papers). This vulnerability surface is addressed by a mandatory evidence-tracking system that requires the agent to source every claim and an output sanitization layer that prevents embedded instructions from executing in the final report context.
[DYNAMIC_EXECUTION]: Logic in gov_bid_api.py and match_scorer.py is deterministic. The scripts avoid using eval(), exec(), or other unsafe dynamic execution patterns, specifically using safe path resolution for mapping data fields.

match-technology-transfer-opportunities-ip