patent-family-analyzer
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves patent information from external databases and incorporates it into an interactive HTML report. The implementation in
scripts/analyze_family.pyperforms direct string interpolation of technical data into an HTML template without evidence of escaping. This creates a surface where malicious content within a patent could potentially influence the agent or the report viewer. - Ingestion points: Technical patent data retrieved via the
patent.fetchtool. - Boundary markers: Absent; the instructions do not specify delimiters or guidelines to ignore instructions embedded in patent text.
- Capability inventory: The skill can write to the session filesystem and execute internal Python scripts.
- Sanitization: No HTML escaping or sanitization is implemented for technical data fields interpolated into the HTML template.
- [COMMAND_EXECUTION]: The skill utilizes a bundled Python script,
scripts/analyze_family.py, to synthesize analysis results into a report. This command execution is part of the skill's core functionality for data visualization and report generation.
Audit Metadata