easyeda-api
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of JavaScript code within the EasyEDA Pro client by setting up a local bridge server. It uses Node.js to run a background server and utilizes
curlcommands to send code execution requests to this local bridge. - Evidence:
SKILL.mdcontains instructions to startscripts/bridge-server.mjsin the background and execute code via POST requests tohttp://localhost:49620/execute. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of standard dependencies from the npm registry to enable its WebSocket communication functionality.
- Evidence:
package.jsonlistswsas a dependency, andSKILL.mdinstructs the agent to runnpm install. - [PROMPT_INJECTION]: Documentation files mention specific URL parameters for the EasyEDA platform, such as
safetyMode=trueandDANGEROUS_OPERATION_DeleteExtensionStorage=true. These were flagged by static detectors but are actually descriptions of legitimate safety and recovery features of the EasyEDA software, not malicious attempts to subvert the AI agent. - Evidence:
guide/error-handling.mdandguide/invoke-apis.mddescribe these developer-focused debugging and recovery flags.
Audit Metadata