patent-panorama-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-supplied Excel files (e.g., patent titles, applicant names, and abstracts) to generate an interactive HTML report.
- Ingestion points:
SKILL.md(Step 1) andscripts/patent_analyzer.pyread Excel files provided by the user at runtime. - Capability inventory: The skill uses
pandasfor data extraction and generates an HTML file containing ECharts visualizations and editable text regions (contenteditable="true"). - Boundary markers: The instructions do not define clear boundaries or provide guidance to the agent to treat input data as untrusted when interpolating it into the HTML report structure.
- Sanitization: While
scripts/patent_analyzer.pyperforms data normalization (e.g.,clean_applicant), there is no evidence of HTML escaping or sanitization logic to prevent malicious content within the Excel files from executing script context in the generated report.
Audit Metadata