trademark-search
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches trademark data from the official TMview public API.
- Evidence:
scripts/tmview-search.shcommunicates withhttps://www.tmdn.org/tmview/api/search/resultsto retrieve trademark information. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes trademark names and applicant details from an external source, creating a potential surface for indirect prompt injection if an attacker were to register marks containing malicious instructions.
- Ingestion points: Trademark records are retrieved from the
tmdn.orgAPI into the scriptscripts/tmview-search.sh. - Boundary markers: The script formats the output into a tabulated report with clear headers, which helps the agent distinguish search results from system instructions.
- Capability inventory: The skill utilizes
curlfor network access andjqfor parsing but does not execute external data as code. - Sanitization: The script uses
jqto extract and normalize specific data fields (like Nice classes and status) before they are displayed to the agent.
Audit Metadata