digikey
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto callpdftotextfor datasheet verification and a schematic analyzer for KiCad projects. These calls use fixed argument lists rather than shell interpolation, preventing command injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files to determine search terms and download locations.
- Ingestion points: Reads component information from
.kicad_schfiles and user-provided MPN lists (.txt). - Boundary markers: No explicit markers are used in the data ingestion phase.
- Capability inventory: Performs network downloads via
requestsandplaywright, writes files to the local filesystem, and executes specific analysis tools via subprocess. - Sanitization: Implements
sanitize_filenameandfriendly_filenamefunctions to validate and clean data before using it to create files on disk. - [EXTERNAL_DOWNLOADS]: The skill fetches content from DigiKey's official API (
api.digikey.com) and well-known electronic component manufacturers like TI and Microchip. These are established services in the electronics industry.
Audit Metadata