skills/diodeinc/pcb/librarian/Gen Agent Trust Hub

librarian

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external electronic component providers (LCSC, CSE, DigiKey) and manufacturer datasheets. This data enters the agent's context during search and curation tasks, representing a potential surface for instructions embedded in external metadata. The skill mitigates this by instructing the agent to select exact manufacturer/MPN matches and to use verified geometry sources.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes curl to fetch component assets (symbols, footprints, STEP models) from temporary signed URLs generated by the pcb tool. These downloads are functional requirements for component curation and are limited to specific file types intended for CAD/EDA use rather than executable scripts.
  • [COMMAND_EXECUTION]: The skill relies on local CLI tools (pcb, kicad-cli) to perform registry operations and file conversions. These commands are used for their intended administrative and design purposes within the PCB development workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 12:47 PM
Security Audit — agent-trust-hub — librarian