hardware-solution
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a bundled Python script (
scripts/md_to_pdf.py) to aggregate markdown files into a formatted PDF report. This operation is a core part of the skill's intended document-delivery workflow. - [EXTERNAL_DOWNLOADS]: The workflow involves fetching hardware datasheets and footprints from well-known industry platforms such as AllDatasheet, LCSC, SnapEDA, and Ultra Librarian. It also specifies the installation of standard Python packages, specifically
weasyprintandmarkdown, to support the report generation script. - [INDIRECT_PROMPT_INJECTION]: The skill manages a workflow that ingests external data, creating an attack surface for indirect prompt injection.
- Ingestion points: Technical documentation in PDF format and footprint files are downloaded from third-party hardware platforms into the
docs/hardware/directory for processing. - Boundary markers: There are no explicit instructions or delimiters defined to isolate the content of these external files from the agent's instructional context.
- Capability inventory: The agent is authorized to write to the local file system and execute shell commands via Python to generate final deliverables.
- Sanitization: The skill enforces a file extension check to ensure downloads are PDFs, but does not specify sanitization or filtering of the document's content before ingestion.
- [DYNAMIC_EXECUTION]: The documentation references the use of specialized MCP (Model Context Protocol) servers, such as
kicad-mcporjlceda-mcp, which provide APIs to programmatically control Electronic Design Automation (EDA) software for generating schematics and PCB data.
Audit Metadata