Agent skill · Audited from source
Digikey
skill · aklofas/kicad-happyMIT licenceAudited 15 Oct 2026 · source 4790730940af
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 4790730940af and observed filesystem and network access and no hard-coded secrets. The audit raised 9 findings, 1 critical or high. What it does: Search DigiKey for electronic components and download datasheets — primary source for prototype orders and the preferred API method for fetching datasheets. Find parts by keyword or MPN, check pricing/stock, download…
Cite
Cite this page
ModelsAtlas. “Digikey (aklofas/kicad-happy)”. Retrieved 15 Oct 2026. https://modelsatlas.com/skills/aklofas/digikey
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in SKILL.md:66. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 15 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemDeclared2 observations
- NetworkDeclared5 observations
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 5 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 3 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 1 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: critical finding, no behavioural pass, undeclared transfer.
Findings (9)
CRITICALPrompt injectionprompt.transfer_instruction · SKILL.md:66
curl -s -X POST https://api.digikey.com/v1/oauth2/token \
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
MEDIUMInventory / provenanceinv.symlink · .agents/skills/bom
.agents/skills/bom
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/datasheets
.agents/skills/datasheets
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/digikey
.agents/skills/digikey
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/element14
.agents/skills/element14
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/emc
.agents/skills/emc
- Why
- link not followed
- Fix
- —
MEDIUMObfuscation / stealthobf.homoglyph · scripts/sync_datasheets_digikey.py:52
r"^[\d.]+\s*[pnuμmkMGR]?[FHΩRfhω]?$" # 100nF, 10K, 4.7uF, 100R
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.homoglyph · scripts/sync_datasheets_digikey.py:54
r"|^[\d.]+\s*[pnuμm]?[Ff]$" # 100pF, 10uF
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.homoglyph · scripts/sync_datasheets_digikey.py:55
r"|^[\d.]+\s*[pnuμm]?[Hh]$" # 10uH
- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 4790730940af · 15 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisheraklofas GitHub userOwner of the repository this skill is read from
- Source folderaklofas/kicad-happy/skills/digikeyThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict4790730940afA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Search DigiKey for electronic components and download datasheets — primary source for prototype orders and the preferred API method for fetching datasheets. Find parts by keyword or MPN, check pricing/stock, download…
---
name: digikey
description: >-
Search DigiKey for electronic components and download datasheets — primary
source for prototype orders and the preferred API method for fetching
datasheets. Find parts by keyword or MPN, check pricing/stock, download
datasheets via API, analyze specifications. Sync and maintain a local
datasheets directory — extract components from schematics, download missing
datasheets, keep them up to date. Also supports batch MPN-list seeding
(`--mpn-list`) for bulk workflows without a KiCad project. Use when the user asks about electronic
components, part specs, datasheets, pricing, stock, footprints, or needs to
download a datasheet — even without mentioning "DigiKey". Also for "sync
datasheets", "download datasheets for my board/project", or mentions a
datasheets directory. DigiKey is the default distributor for prototyping. For
BOM workflows, see the bom skill.
---
# DigiKey Parts Search & Analysis
## Related Skills
| Skill | Purpose |
|-------|---------|
| `kicad` | Schematic analysis — extracts MPNs for datasheet sync |
| `bom` | BOM management — orchestrates sourcing across distributors |
| `spice` | Uses DigiKey parametric data for behavioral SPICE models |
DigiKey is the **primary source for prototype orders** (Mouser is secondary). Its API returns direct PDF datasheet links, making it the preferred datasheet source. For production orders, see `lcsc`/`jlcpcb`. For BOM management and export workflows, see `bom`.
## API Credential Setup
The DigiKey API requires OAuth 2.0 credentials. Here's how to set them up:
1. **Create a DigiKey account** at [digikey.com](https://www.digikey.com) if you don't have one
2. **Register an API app** at [developer.digikey.com](https://developer.digikey.com):
- Sign in with your DigiKey account
- Go to "My Apps" → "Create App"
- App name: anything (e.g., "kicad-happy")
- Select **"Product Information v4"** API
- OAuth type: **Client Credentials** (2-legged, no user login needed)
- Callback URL: `https://localhost` (not used for client credentials, but required)
- After creation, note the **Client ID** and **Client Secret**
3. **Set the environment variables** before running the scripts:
```bash
export DIGIKEY_CLIENT_ID=your_client_id_here
export DIGIKEY_CLIENT_SECRET=your_client_secret_here
```
If credentials are stored in a central secrets file (e.g., `~/.config/secrets.env`), load them first:
```bash
export $(grep -v '^#' ~/.config/secrets.env | grep -v '^$' | xargs)
```
The client credentials flow has no user interaction — once configured, API calls work automatically.
## DigiKey Product Information API v4
The API is the preferred way to search DigiKey. It returns structured JSON with full product details, pricing, stock, datasheets, and parametric data.
**Base URL:** `https://api.digikey.com`
### Authentication
All API requests require OAuth 2.0. Use the **client credentials flow** (2-legged). Credentials must be loaded as environment variables (see "API Credential Setup" above).
```bash
curl -s -X POST https://api.digikey.com/v1/oauth2/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "client_id=${DIGIKEY_CLIENT_ID}&client_secret=${DIGIKEY_CLIENT_SECRET}&grant_type=client_credentials"
```
The response returns an `access_token` valid for **10 minutes**. Cache the token in a shell variable and reuse it for subsequent calls in the same session. If you get a 401 error mid-session, the token has expired — re-authenticate to get a fresh one.
### Required Headers
Every API call needs:
```
X-DIGIKEY-Client-Id: ${DIGIKEY_CLIENT_ID}
Authorization: Bearer <access_token>
```
Optional locale headers:
- `X-DIGIKEY-Locale-Language`: `en` (default), `ja`, `de`, `fr`, `ko`, `zhs`, `zht`, `it`, `es`
- `X-DIGIKEY-Locale-Currency`: `USD` (default), `CAD`, `EUR`, `GBP`, `JPY`, etc.
- `X-DIGIKEY-Locale-Site`: `US` (default), `CA`, `UK`, `DE`, etc.
### KeywordSearch — Find Parts
```
POST /products/v4/search/keyword
```
This is the primary search endpoint. Search by MPN, DigiKey part number, description, or keywords.
Request body:
```json
{
"Keywords": "GRM155R71C104KA88D",
"Limit": 25,
"Offset": 0,
"FilterOptionsRequest": {
"MinimumQuantityAvailable": 1,
"SearchOptions": ["InStock", "HasDatasheet", "RoHSCompliant"],
"ManufacturerFilter": [{"Id": "..."}],
"CategoryFilter": [{"Id": "..."}],
"StatusFilter": [{"Id": "..."}],
"MarketPlaceFilter": "ExcludeMarketPlace"
},
"SortOptions": {
"Field": "Price",
"SortOrder": "Ascending"
}
}
```
Key request fields:
- `Keywords` (string, max 250 chars) — search term (MPN, DK PN, description)
- `Limit` (int, 1-50) — results per page
- `Offset` (int) — pagination offset
- `SearchOptions` — array of: `InStock`, `HasDatasheet`, `RoHSCompliant`, `NormallyStocking`, `Has3DModel`, `HasCadModel`, `HasProductPhoto`, `NewProduct`
- `SortOptions.Field` — `Price`, `QuantityAvailable`, `Manufacturer`, `ManufacturerProductNumber`, `DigiKeyProductNumber`, `MinimumQuantity`
- `MarketPlaceFilter` — `NoFilter`, `ExcludeMarketPlace`, `MarketPlaceOnly`
Response — key fields in each `Products[]` item:
```json
{
"ManufacturerProductNumber": "GRM155R71C104KA88D",
"Manufacturer": {"Id": 563, "Name": "Murata Electronics"},
"Description": {
"ProductDescription": "CAP CER 100NF 16V X7R 0402",
"DetailedDescription": "..."
},
"UnitPrice": 0.01,
"QuantityAvailable": 248000,
"ProductUrl": "https://www.digikey.com/...",
"DatasheetUrl": "https://...",
"PhotoUrl": "https://...",
"ProductVariations": [
{
"DigiKeyProductNumber": "490-10698-1-ND",
"PackageType": {"Name": "Cut Tape"},
"StandardPricing": [
{"BreakQuantity": 1, "UnitPrice": 0.01, "TotalPrice": 0.01},
{"BreakQuantity": 10, "UnitPrice": 0.008, "TotalPrice": 0.08}
],
"QuantityAvailableforPackageType": 248000,
"MinimumOrderQuantity": 1,
"StandarExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 4790730
git clone https://github.com/aklofas/kicad-happy git -C kicad-happy checkout 4790730940af
The author documents no install command, so this uses the repository directly. Our verdict covers commit 4790730940af only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
4790730940af
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/aklofas/digikey/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
aklofas/kicad-happy
BOM (Bill of Materials) management for electronics projects — the workflow skill that coordinates DigiKey, Mouser, LCSC, element14, JLCPCB, PCBWay, and KiCad skills around a unified BOM lifecycle. Create, update, and…
aklofas/kicad-happy
Extract structured specifications from electronic component datasheet PDFs — pinouts, electrical characteristics, peripherals, topology, and features. Cache extractions per project for consumption by schematic and PCB…
aklofas/kicad-happy
JLCPCB PCB fabrication and assembly — BOM/CPL generation, basic vs extended parts, assembly constraints, design rules, ordering workflow. Use with KiCad for JLCPCB manufacturing. Use this skill when the user mentions…
aklofas/kicad-happy
PCBWay PCB fabrication and assembly — turnkey/consigned assembly, design rules, ordering workflow. Alternative to JLCPCB for manufacturing. Use with KiCad. Use this skill when the user mentions PCBWay, needs turnkey…
aklofas/kicad-happy
Search Newark, Farnell, and element14 for electronic components — find parts by MPN or distributor part number, check pricing/stock, download datasheets, analyze specifications. One unified API covers all three…
aklofas/kicad-happy
AI coding agent skills for KiCad electronics design. Works with Claude Code and OpenAI Codex. Analyze schematics, review PCB layouts, EMC pre-compliance, SPICE simulation, download datasheets, source components, and…
Add this badge to your README
[](https://modelsatlas.com/skills/aklofas/digikey/)
<a href="https://modelsatlas.com/skills/aklofas/digikey/"><img src="https://modelsatlas.com/skills/aklofas/digikey/badge.svg" alt="ModelsAtlas: BLOCK D"></a>
Questions about Digikey
What does the Digikey skill do?
Is Digikey safe to install?
What can Digikey access on my machine?
How current is this page?
Sources
- github.com/aklofas/kicad-happy/tree/main/skills/digikey — the audited source at commit 4790730940af and every finding aboveObserved · 15 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Digikey skill do?
- Is Digikey safe to install?
- What can Digikey access on my machine?