kicad-bom

SUSPICIOUS: the skill's purpose is legitimate, but its core workflow routes project-derived data through third-party MCP services and instructs the agent to rely on/install them without strong provenance or clear data-use boundaries. This is not confirmed malware, but it introduces meaningful supply-chain and data-flow risk beyond a simple KiCad BOM helper.