The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/nextpcb_search.py contains hardcoded API credentials, including an appid ("j1LWf238") and a signature ("8e02b899be91b77dc140dfc2388dde95"), used to authenticate requests to the NextPCB API.
[DATA_EXFILTRATION]: The script scripts/nextpcb_search.py performs network requests to external domains eda.cn and nextpcb.com to fetch part information and stock data based on user queries.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and displays data from external APIs without sanitization.
Ingestion points: Electronic part data (MPN, Manufacturer, Category, etc.) is fetched from external APIs in scripts/nextpcb_search.py at lines 38 and 58.
Boundary markers: The data is displayed in a formatted table, but there are no explicit delimiters or instructions telling the agent to ignore any potential instructions embedded in the API responses.
Capability inventory: The script possesses network access capabilities via the requests library.
Sanitization: There is no evidence of sanitization, filtering, or validation of the text content returned by the external APIs before it is presented to the agent.

hardware-design