element14
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The scripts execute external commands using
subprocess.runto perform necessary tasks. fetch_datasheet_element14.pyinvokes thepdftotextutility to extract text from downloaded PDF datasheets for automated verification.sync_datasheets_element14.pyexecutes a sibling scriptanalyze_schematic.py(located in a relativekicadskill directory) to extract component data from KiCad project files.- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing data from untrusted external sources.
- Ingestion points: The skill reads data from local KiCad schematic files (
.kicad_sch), text-based MPN lists, and the extracted text content of remote PDF datasheets. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands when the content or verification results of these external files are processed and presented to the agent.
- Capability inventory: The skill is capable of network communication (API search and file downloads), file system writes (saving PDFs and manifests), and command execution (
pdftotextand schematic analysis). - Sanitization: While basic filtering is applied to identifiers (MPNs), the skill does not sanitize the extracted text from PDFs or schematic metadata before it is potentially interpreted by the agent's logic.
- [EXTERNAL_DOWNLOADS]: The skill downloads component documentation from external vendors and distributors.
- It fetches datasheet PDFs from element14's CDN (
farnell.com) and Microchip Technology (microchip.com). These are recognized as well-known and legitimate sources for electronic component data.
Audit Metadata