Agent skill · Audited from source

Digikey

skill · aklofas/kicad-happyMIT licenceAudited 15 Oct 2026 · source 4790730940af

★ 1,394pushed today
✕BLOCKGrade D · 69/100 · 9 findings · 4790730
1,394repo stars · whole aklofas/kicad-happy

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 4790730940af and observed filesystem and network access and no hard-coded secrets. The audit raised 9 findings, 1 critical or high. What it does: Search DigiKey for electronic components and download datasheets — primary source for prototype orders and the preferred API method for fetching datasheets. Find parts by keyword or MPN, check pricing/stock, download…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “Digikey (aklofas/kicad-happy)”. Retrieved 15 Oct 2026. https://modelsatlas.com/skills/aklofas/digikey

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 1 critical or high finding, starting with “Prompt injection” in SKILL.md:66. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 15 Oct 2026

Trust score69/100✕BLOCK D
1 critical0 high8 medium0 low0 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemDeclared2 observations
  • NetworkDeclared5 observations
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN5
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN3
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL1
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: critical finding, no behavioural pass, undeclared transfer.

Findings (9)

CRITICALPrompt injectionprompt.transfer_instruction · SKILL.md:66
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
curl -s -X POST https://api.digikey.com/v1/oauth2/token \
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
MEDIUMObfuscation / stealthobf.homoglyph · scripts/sync_datasheets_digikey.py:52
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
r"^[\d.]+\s*[pnuμmkMGR]?[FHΩRfhω]?$"    # 100nF, 10K, 4.7uF, 100R
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.homoglyph · scripts/sync_datasheets_digikey.py:54
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
r"|^[\d.]+\s*[pnuμm]?[Ff]$"               # 100pF, 10uF
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.homoglyph · scripts/sync_datasheets_digikey.py:55
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
r"|^[\d.]+\s*[pnuμm]?[Hh]$"               # 10uH
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 4790730940af · 15 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisheraklofas GitHub userOwner of the repository this skill is read from
  • Source folderaklofas/kicad-happy/skills/digikeyThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict4790730940afA new audit runs when the source changes
  • Repository statusNot archivedPushed today
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Search DigiKey for electronic components and download datasheets — primary source for prototype orders and the preferred API method for fetching datasheets. Find parts by keyword or MPN, check pricing/stock, download…

---
name: digikey
description: >-
  Search DigiKey for electronic components and download datasheets — primary
  source for prototype orders and the preferred API method for fetching
  datasheets. Find parts by keyword or MPN, check pricing/stock, download
  datasheets via API, analyze specifications. Sync and maintain a local
  datasheets directory — extract components from schematics, download missing
  datasheets, keep them up to date. Also supports batch MPN-list seeding
  (`--mpn-list`) for bulk workflows without a KiCad project. Use when the user asks about electronic
  components, part specs, datasheets, pricing, stock, footprints, or needs to
  download a datasheet — even without mentioning "DigiKey". Also for "sync
  datasheets", "download datasheets for my board/project", or mentions a
  datasheets directory. DigiKey is the default distributor for prototyping. For
  BOM workflows, see the bom skill.
---

# DigiKey Parts Search & Analysis

## Related Skills

| Skill | Purpose |
|-------|---------|
| `kicad` | Schematic analysis — extracts MPNs for datasheet sync |
| `bom` | BOM management — orchestrates sourcing across distributors |
| `spice` | Uses DigiKey parametric data for behavioral SPICE models |

DigiKey is the **primary source for prototype orders** (Mouser is secondary). Its API returns direct PDF datasheet links, making it the preferred datasheet source. For production orders, see `lcsc`/`jlcpcb`. For BOM management and export workflows, see `bom`.

## API Credential Setup

The DigiKey API requires OAuth 2.0 credentials. Here's how to set them up:

1. **Create a DigiKey account** at [digikey.com](https://www.digikey.com) if you don't have one
2. **Register an API app** at [developer.digikey.com](https://developer.digikey.com):
   - Sign in with your DigiKey account
   - Go to "My Apps" → "Create App"
   - App name: anything (e.g., "kicad-happy")
   - Select **"Product Information v4"** API
   - OAuth type: **Client Credentials** (2-legged, no user login needed)
   - Callback URL: `https://localhost` (not used for client credentials, but required)
   - After creation, note the **Client ID** and **Client Secret**
3. **Set the environment variables** before running the scripts:
   ```bash
   export DIGIKEY_CLIENT_ID=your_client_id_here
   export DIGIKEY_CLIENT_SECRET=your_client_secret_here
   ```
   If credentials are stored in a central secrets file (e.g., `~/.config/secrets.env`), load them first:
   ```bash
   export $(grep -v '^#' ~/.config/secrets.env | grep -v '^$' | xargs)
   ```

The client credentials flow has no user interaction — once configured, API calls work automatically.

## DigiKey Product Information API v4

The API is the preferred way to search DigiKey. It returns structured JSON with full product details, pricing, stock, datasheets, and parametric data.

**Base URL:** `https://api.digikey.com`

### Authentication

All API requests require OAuth 2.0. Use the **client credentials flow** (2-legged). Credentials must be loaded as environment variables (see "API Credential Setup" above).

```bash
curl -s -X POST https://api.digikey.com/v1/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=${DIGIKEY_CLIENT_ID}&client_secret=${DIGIKEY_CLIENT_SECRET}&grant_type=client_credentials"
```

The response returns an `access_token` valid for **10 minutes**. Cache the token in a shell variable and reuse it for subsequent calls in the same session. If you get a 401 error mid-session, the token has expired — re-authenticate to get a fresh one.

### Required Headers

Every API call needs:
```
X-DIGIKEY-Client-Id: ${DIGIKEY_CLIENT_ID}
Authorization: Bearer <access_token>
```

Optional locale headers:
- `X-DIGIKEY-Locale-Language`: `en` (default), `ja`, `de`, `fr`, `ko`, `zhs`, `zht`, `it`, `es`
- `X-DIGIKEY-Locale-Currency`: `USD` (default), `CAD`, `EUR`, `GBP`, `JPY`, etc.
- `X-DIGIKEY-Locale-Site`: `US` (default), `CA`, `UK`, `DE`, etc.

### KeywordSearch — Find Parts

```
POST /products/v4/search/keyword
```

This is the primary search endpoint. Search by MPN, DigiKey part number, description, or keywords.

Request body:
```json
{
  "Keywords": "GRM155R71C104KA88D",
  "Limit": 25,
  "Offset": 0,
  "FilterOptionsRequest": {
    "MinimumQuantityAvailable": 1,
    "SearchOptions": ["InStock", "HasDatasheet", "RoHSCompliant"],
    "ManufacturerFilter": [{"Id": "..."}],
    "CategoryFilter": [{"Id": "..."}],
    "StatusFilter": [{"Id": "..."}],
    "MarketPlaceFilter": "ExcludeMarketPlace"
  },
  "SortOptions": {
    "Field": "Price",
    "SortOrder": "Ascending"
  }
}
```

Key request fields:
- `Keywords` (string, max 250 chars) — search term (MPN, DK PN, description)
- `Limit` (int, 1-50) — results per page
- `Offset` (int) — pagination offset
- `SearchOptions` — array of: `InStock`, `HasDatasheet`, `RoHSCompliant`, `NormallyStocking`, `Has3DModel`, `HasCadModel`, `HasProductPhoto`, `NewProduct`
- `SortOptions.Field` — `Price`, `QuantityAvailable`, `Manufacturer`, `ManufacturerProductNumber`, `DigiKeyProductNumber`, `MinimumQuantity`
- `MarketPlaceFilter` — `NoFilter`, `ExcludeMarketPlace`, `MarketPlaceOnly`

Response — key fields in each `Products[]` item:
```json
{
  "ManufacturerProductNumber": "GRM155R71C104KA88D",
  "Manufacturer": {"Id": 563, "Name": "Murata Electronics"},
  "Description": {
    "ProductDescription": "CAP CER 100NF 16V X7R 0402",
    "DetailedDescription": "..."
  },
  "UnitPrice": 0.01,
  "QuantityAvailable": 248000,
  "ProductUrl": "https://www.digikey.com/...",
  "DatasheetUrl": "https://...",
  "PhotoUrl": "https://...",
  "ProductVariations": [
    {
      "DigiKeyProductNumber": "490-10698-1-ND",
      "PackageType": {"Name": "Cut Tape"},
      "StandardPricing": [
        {"BreakQuantity": 1, "UnitPrice": 0.01, "TotalPrice": 0.01},
        {"BreakQuantity": 10, "UnitPrice": 0.008, "TotalPrice": 0.08}
      ],
      "QuantityAvailableforPackageType": 248000,
      "MinimumOrderQuantity": 1,
      "Standar

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 4790730

git clone https://github.com/aklofas/kicad-happy
git -C kicad-happy checkout 4790730940af

The author documents no install command, so this uses the repository directly. Our verdict covers commit 4790730940af only.

Works in

The author has not said which agents this skill supports, and we have not tested it in any.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 4790730940af

README badge

For maintainers · shows the latest audit

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D
[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/aklofas/digikey/badge.svg)](https://modelsatlas.com/skills/aklofas/digikey/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

Bom!CAUTION

aklofas/kicad-happy

BOM (Bill of Materials) management for electronics projects — the workflow skill that coordinates DigiKey, Mouser, LCSC, element14, JLCPCB, PCBWay, and KiCad skills around a unified BOM lifecycle. Create, update, and…

★ 1.4kGrade B
Datasheets!CAUTION

aklofas/kicad-happy

Extract structured specifications from electronic component datasheet PDFs — pinouts, electrical characteristics, peripherals, topology, and features. Cache extractions per project for consumption by schematic and PCB…

★ 1.4kGrade B
Jlcpcb!CAUTION

aklofas/kicad-happy

JLCPCB PCB fabrication and assembly — BOM/CPL generation, basic vs extended parts, assembly constraints, design rules, ordering workflow. Use with KiCad for JLCPCB manufacturing. Use this skill when the user mentions…

★ 1.4kGrade B
Pcbway!CAUTION

aklofas/kicad-happy

PCBWay PCB fabrication and assembly — turnkey/consigned assembly, design rules, ordering workflow. Alternative to JLCPCB for manufacturing. Use with KiCad. Use this skill when the user mentions PCBWay, needs turnkey…

★ 1.4kGrade B
Element14!CAUTION

aklofas/kicad-happy

Search Newark, Farnell, and element14 for electronic components — find parts by MPN or distributor part number, check pricing/stock, download datasheets, analyze specifications. One unified API covers all three…

★ 1.4kGrade B
Kidoc!CAUTION

aklofas/kicad-happy

AI coding agent skills for KiCad electronics design. Works with Claude Code and OpenAI Codex. Analyze schematics, review PCB layouts, EMC pre-compliance, SPICE simulation, download datasheets, source components, and…

★ 1.4kGrade B

Add this badge to your README

[![ModelsAtlas: BLOCK D](https://modelsatlas.com/skills/aklofas/digikey/badge.svg)](https://modelsatlas.com/skills/aklofas/digikey/)

Questions about Digikey

What does the Digikey skill do?
AI coding agent skills for KiCad electronics design. Works with Claude Code and OpenAI Codex. Analyze schematics, review PCB layouts, EMC pre-compliance, SPICE simulation, download datasheets, source components, and prep boards for fabrication.
Is Digikey safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can Digikey access on my machine?
The audit observed that it reaches the network and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: none found.
How current is this page?
The grade is for one exact copy of the source (4790730940af), read on 2026-10-15. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.