easyeda-api

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of JavaScript code within the EasyEDA Pro client by setting up a local bridge server. It uses Node.js to run a background server and utilizes curl commands to send code execution requests to this local bridge.
  • Evidence: SKILL.md contains instructions to start scripts/bridge-server.mjs in the background and execute code via POST requests to http://localhost:49620/execute.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of standard dependencies from the npm registry to enable its WebSocket communication functionality.
  • Evidence: package.json lists ws as a dependency, and SKILL.md instructs the agent to run npm install.
  • [PROMPT_INJECTION]: Documentation files mention specific URL parameters for the EasyEDA platform, such as safetyMode=true and DANGEROUS_OPERATION_DeleteExtensionStorage=true. These were flagged by static detectors but are actually descriptions of legitimate safety and recovery features of the EasyEDA software, not malicious attempts to subvert the AI agent.
  • Evidence: guide/error-handling.md and guide/invoke-apis.md describe these developer-focused debugging and recovery flags.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 02:57 PM
Security Audit — agent-trust-hub — easyeda-api