skills/aklofas/kicad-happy/element14/Gen Agent Trust Hub

element14

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The scripts execute external commands using subprocess.run to perform necessary tasks.
  • fetch_datasheet_element14.py invokes the pdftotext utility to extract text from downloaded PDF datasheets for automated verification.
  • sync_datasheets_element14.py executes a sibling script analyze_schematic.py (located in a relative kicad skill directory) to extract component data from KiCad project files.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing data from untrusted external sources.
  • Ingestion points: The skill reads data from local KiCad schematic files (.kicad_sch), text-based MPN lists, and the extracted text content of remote PDF datasheets.
  • Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands when the content or verification results of these external files are processed and presented to the agent.
  • Capability inventory: The skill is capable of network communication (API search and file downloads), file system writes (saving PDFs and manifests), and command execution (pdftotext and schematic analysis).
  • Sanitization: While basic filtering is applied to identifiers (MPNs), the skill does not sanitize the extracted text from PDFs or schematic metadata before it is potentially interpreted by the agent's logic.
  • [EXTERNAL_DOWNLOADS]: The skill downloads component documentation from external vendors and distributors.
  • It fetches datasheet PDFs from element14's CDN (farnell.com) and Microchip Technology (microchip.com). These are recognized as well-known and legitimate sources for electronic component data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:27 PM