kicad-bom

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and instructs the user to install Model Context Protocol (MCP) servers from external domains: pcbparts.dev and api.zenode.ai. It also directs users to a third-party GitHub repository github.com/i2cjak/American_Embedded_KiCad_Template for KiCad templates.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external search results to update KiCad schematic fields, creating a potential vector for indirect prompt injection.
  • Ingestion points: Data retrieved from MCP search tools (e.g., part descriptions and manufacturer data from pcbparts.dev or api.zenode.ai).
  • Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions embedded in the external search data.
  • Capability inventory: The skill is permitted to modify KiCad schematic files to update fields like MPN, Manufacturer, and LCSC numbers.
  • Sanitization: There is no mention of validation or sanitization of the search results before they are applied to the local project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 08:00 PM