jlcpcb
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell command examples for executing a local Python script (translate_bom_pnp.py) to process Bill of Materials (BOM) and Component Placement List (CPL) files as part of the intended manufacturing workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an interaction model that ingests external CSV, XLS, and XLSX data files provided by the user, representing a potential untrusted data surface that is processed by the agent. Evidence: 1. Ingestion points: input_bom.csv and input_cpl.csv (referenced in SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Shell execution of the translate_bom_pnp.py script. 4. Sanitization: Not specified.
- [EXTERNAL_DOWNLOADS]: The skill references official web pages for JLCPCB, LCSC, DigiKey, and Mouser to facilitate component search and manufacturing quotes. These references target well-known industry services.
Audit Metadata