Zeelin Patent Retriever

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  0.1.2

Overview

This patent-search skill mostly matches its purpose, but it needs review because it uses Google Cloud credentials and does not strictly enforce the promised Google Patents BigQuery table scope.

Install only if you are comfortable using your Google Cloud project for BigQuery queries. Use a dedicated least-privilege service account, expect possible BigQuery charges and cloud-side query logging, set billing limits where possible, and review query_plan.json before execution, especially that table remains patents-public-data.patents.publications and that filters and limits match your intent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill requires cloud credentials and sends user-supplied patent research queries to Google BigQuery, but it does not clearly disclose the privacy, data-handling, and billing implications of doing so. Users may unknowingly expose confidential search intent, sensitive technical topics, project identifiers, or incur cloud charges under their own account.

VirusTotal

64/64 vendors flagged this skill as clean.