review-fto-report-quality-ip
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill references several MCP connectors (e.g., patsnap_patent_research, advanced_patent_search) and documentation URLs on open.patsnap.com. These are official resources belonging to the vendor (patsnap) and are used for their intended purpose of patent research and verification. No unauthorized exfiltration of sensitive files or credentials was found.
- [REMOTE_CODE_EXECUTION]: Analysis of the included Python scripts (scripts/generate_report.py, scripts/fto_independent_search.py, scripts/validate_report.py) confirms they rely exclusively on Python standard libraries for data processing and HTML generation. They do not perform remote downloads, dynamic execution of untrusted code, or network-based execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied reports which constitutes an untrusted input surface. However, the architecture utilizes structured evidence registers, fatal-defect gates, and cross-field validation rules that require the AI to ground its findings in specific cited evidence, significantly reducing the risk of accidental obedience to instructions embedded within processed documents.
- [COMMAND_EXECUTION]: Instructions to the agent for running shell commands are limited to executing the provided local Python utility scripts. These scripts are used for formatting and validating audit data and do not incorporate unvalidated user input into shell execution paths.
Audit Metadata