tech-evolution-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted patent and research paper data from external databases via Patsnap's MCP service. This creates a potential surface for indirect prompt injection where malicious content in external documents could attempt to influence the agent's analysis. Evidence includes ingestion of data in Step 3 (references/step3-double-track-search.md) and subsequent processing in Step 5. The skill mitigates this by using structured JSON for internal data passing and applying 'html.escape' in its rendering scripts (assets/forest/triz_forest_common.py and assets/mindmap/render_mindmap.py) to sanitize output.
- [COMMAND_EXECUTION]: The 7-step analysis pipeline requires the agent to execute local, bundled Python scripts (render_mindmap.py and render_forest.py) to generate visual reports. These scripts are part of the skill's core functionality and act as secure data-to-HTML transformers using standard Python libraries.
- [EXTERNAL_DOWNLOADS]: The skill retrieves technical data including patents and academic papers from Patsnap's official databases. These downloads are performed using authorized MCP tools and target vendor-controlled infrastructure, which is consistent with the skill's stated purpose and author identity.
Audit Metadata