tag-patent-search-results-ip
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions.
- Ingestion points: The skill ingests data from
candidate_pool.csv,patent_index.core.json, and the human-returnedtagged_pool.csv(Steps 0, 8, and the Stage 3.5 boundary). - Boundary markers: The skill explicitly requires validating the returned dataset and reconciling row counts and identifier checksums (Step 8).
- Capability inventory: The skill possesses file-write capabilities (
tech_breakdown.json,patent_packages.csv, etc.) and invokes external MCP tools (deep_patent_mining,patent_briefing). - Sanitization: The instructions explicitly mandate neutralizing formula-leading values (e.g.,
=,@,+,-) for spreadsheet safety and escaping embedded control characters to prevent CSV injection attacks (Step 8). - [EXTERNAL_DOWNLOADS]: The skill references external MCP (Model Context Protocol) services for patent mining and briefing.
- Evidence: The skill suggests using connectors located at
open.patsnap.com/marketplace/mcp-servers/patent-miningandopen.patsnap.com/marketplace/mcp-servers/patent-briefing. - Context: These resources are official marketplace services provided by the vendor (Patsnap) to facilitate the intended patent analysis workflow.
Audit Metadata