zhihuiya-patent-html-report
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for HTML validation and testing.
- Evidence: The skill instructs the agent to execute
python3 -m html.parserandrg(ripgrep) commands on generated reports to verify link integrity and HTML structure. - Evidence: Mentions using Playwright to test the interactive hover functionality in the generated reports.
- [DYNAMIC_EXECUTION]: The skill generates HTML reports containing embedded JavaScript for user interface enhancements.
- Evidence:
references/report-spec.mdprovides a JavaScript IIFE (Immediately Invoked Function Expression) to be embedded in reports for fixed-position image hover previews. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection by ingesting untrusted data from external patent and news sources into HTML templates.
- Ingestion points: Data enters the context via
ls_*andpatsnap_*MCP tools (patent data, news, clinical trials) inSKILL.md. - Boundary markers: Absent; data is interpolated directly into V6-style HTML structures.
- Capability inventory: The skill has file-write access to the
reports/directory and can execute shell commands (rg,python3) for validation. - Sanitization: Not explicitly defined for the content of the patent data being processed.
- [EXTERNAL_DOWNLOADS]: The skill references external dependencies and services for data retrieval and testing.
- Evidence: Usage of Patsnap/智慧芽 MCP tools for fetching real-time data from
zhihuiya.comdomains. - Evidence: Mentions
Playwrightas a testing dependency for verifying HTML report functionality.
Audit Metadata