uspto-database
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows secure coding practices by directing users to store API keys in environment variables rather than hardcoding them in the skill or scripts.
- [EXTERNAL_DOWNLOADS]: The skill facilitates data retrieval from official government sources (uspto.gov) and well-known official-support platforms (patentsview.org).
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external USPTO records, creating a theoretical attack surface for indirect prompt injection via record content.
- Ingestion points: Patent search and trademark record retrieval via API endpoints specified in SKILL.md.
- Boundary markers: No specific delimiters or boundary markers for external content are defined in the sample code.
- Capability inventory: The skill is limited to fetching and logging data, with no subprocess or dynamic execution capabilities identified.
- Sanitization: There is no evidence of specific input sanitization for the data retrieved from the APIs before it is logged or presented to the agent.
Audit Metadata