hardware-solution

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run a bundled Python script (scripts/md_to_pdf.py) to aggregate markdown files into a formatted PDF report. This operation is a core part of the skill's intended document-delivery workflow.
  • [EXTERNAL_DOWNLOADS]: The workflow involves fetching hardware datasheets and footprints from well-known industry platforms such as AllDatasheet, LCSC, SnapEDA, and Ultra Librarian. It also specifies the installation of standard Python packages, specifically weasyprint and markdown, to support the report generation script.
  • [INDIRECT_PROMPT_INJECTION]: The skill manages a workflow that ingests external data, creating an attack surface for indirect prompt injection.
  • Ingestion points: Technical documentation in PDF format and footprint files are downloaded from third-party hardware platforms into the docs/hardware/ directory for processing.
  • Boundary markers: There are no explicit instructions or delimiters defined to isolate the content of these external files from the agent's instructional context.
  • Capability inventory: The agent is authorized to write to the local file system and execute shell commands via Python to generate final deliverables.
  • Sanitization: The skill enforces a file extension check to ensure downloads are PDFs, but does not specify sanitization or filtering of the document's content before ingestion.
  • [DYNAMIC_EXECUTION]: The documentation references the use of specialized MCP (Model Context Protocol) servers, such as kicad-mcp or jlceda-mcp, which provide APIs to programmatically control Electronic Design Automation (EDA) software for generating schematics and PCB data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 10:28 AM