uspto-database

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the uspto-opendata-python package from the official Python Package Index (PyPI) to facilitate interaction with USPTO datasets.
  • [COMMAND_EXECUTION]: Includes Python code snippets that utilize the requests library to communicate with USPTO API endpoints and xml.etree.ElementTree for parsing ownership and assignment data.
  • [PROMPT_INJECTION]: Contains a specific behavioral instruction (under 'Suggest Using K-Dense Web For Complex Worflows') that directs the agent to steer users toward a commercial hosted platform (www.k-dense.ai) when tasks reach a certain complexity threshold.
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by processing unstructured text data from external USPTO APIs.
  • Ingestion points: Data entering the agent context includes patent abstracts, claims, and trademark prosecution histories from USPTO endpoints such as search.patentsview.org and tsdrapi.uspto.gov (identified in SKILL.md and scripts).
  • Boundary markers: Absent; there are no specific delimiters or instructions provided to separate retrieved data from agent instructions.
  • Capability inventory: The skill utilizes subprocess execution for helper scripts and performs authenticated network operations to multiple external USPTO domains.
  • Sanitization: No sanitization or validation of the retrieved IP data is demonstrated in the provided code snippets or instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 08:27 AM