skills/aklofas/kicad-happy/digikey/Gen Agent Trust Hub

digikey

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to call pdftotext for datasheet verification and a schematic analyzer for KiCad projects. These calls use fixed argument lists rather than shell interpolation, preventing command injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files to determine search terms and download locations.
  • Ingestion points: Reads component information from .kicad_sch files and user-provided MPN lists (.txt).
  • Boundary markers: No explicit markers are used in the data ingestion phase.
  • Capability inventory: Performs network downloads via requests and playwright, writes files to the local filesystem, and executes specific analysis tools via subprocess.
  • Sanitization: Implements sanitize_filename and friendly_filename functions to validate and clean data before using it to create files on disk.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from DigiKey's official API (api.digikey.com) and well-known electronic component manufacturers like TI and Microchip. These are established services in the electronics industry.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:27 PM