uspto-database
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (MEDIUM): The skill relies on the 'uspto-opendata-python' library, an external dependency from PyPI. This introduces a supply chain risk as the package is not from a predefined trusted organization.
- [DATA_EXFILTRATION] (LOW): The scripts 'scripts/patent_search.py' and 'scripts/peds_client.py' perform network requests to USPTO domains (search.patentsview.org, tsdrapi.uspto.gov, and assignment-api.uspto.gov) to retrieve data. While necessary for the skill, these are non-whitelisted external communications.
- [PROMPT_INJECTION] (LOW): The skill handles untrusted external content (Category 8). It ingests patent abstracts, claims, and correspondence text from USPTO APIs. Ingestion points: JSON and XML responses processed in 'scripts/patent_search.py' and 'scripts/peds_client.py'. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the provided scripts. Capability inventory: The retrieved data is displayed to the user or agent but is not used to drive file-system writes or shell execution. Sanitization: No sanitization is performed on the text data before it is presented to the agent.
Audit Metadata