Agent skill · Audited from source

easyeda-api

skill · easyeda/easyeda-api-skillLicence not declaredAudited 20 Oct 2026 · source 223be8c6e8ce

★ 942pushed 3 days agoversion 1.1.56
✕BLOCKGrade D · 69/100 · 8 findings · 223be8c
942repo stars · whole easyeda/easyeda-api-skill

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 223be8c6e8ce and observed network access and no hard-coded secrets. The audit raised 8 findings, 2 critical or high. What it does: EasyEDA Pro API skill for AI agents. Use when working with EasyEDA Pro EDA software, including PCB design, schematic editing, footprint/symbol management, and project operations. Supports live debugging in EasyEDA and…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “easyeda-api (easyeda/easyeda-api-skill)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/easyeda/easyeda-api

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Prompt injection” in SKILL.md:135. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 20 Oct 2026

Trust score69/100✕BLOCK D
0 critical2 high2 medium2 low2 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkDeclared2 observations
  • ShellNone observedNo commands run in the source
  • DependenciesNot pinnedSome versions float
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS1
L1 Static sourceSecrets, path traversal, supply chain, hidden codeWARN3
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL4
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass, no license.

Findings (8)

HIGHPrompt injectionprompt.fetch_and_trust · SKILL.md:135
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **0 windows**: Tell user "No EasyEDA window is connected. Please ensure the EasyEDA extension (run-api-gateway.eext) is installed and loaded in EasyEDA. Download: https://jlc-ext.com/item/oshwhub/ru
Why
remote text is to be obeyed as instructions
Fix
—
HIGHPrompt injectionprompt.fetch_and_trust · SKILL.md:677
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
2. **EDA not connected?**: Ensure bridge extension is loaded in EasyEDA. Download: https://jlc-ext.com/item/oshwhub/run-api-gateway
Why
remote text is to be obeyed as instructions
Fix
—
MEDIUMNetwork egressnet.raw_ip · SKILL.md:274
F-04 Network egressCWE-200 · CWE-319Layer L1
resp=$(curl -s http://127.0.0.1:$port/health 2>/dev/null)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · scripts/bridge-server.mjs:94
F-04 Network egressCWE-200 · CWE-319Layer L1
const req = httpGet(`http://127.0.0.1:${port}/health`, { timeout: 800 }, (res) => {
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.no_license
F-13 Inventory / provenanceCWE-1104Layer L0
Why
no LICENSE file and no repo licence
Fix
add a licence
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
ws
Why
1 dependency range(s) float
Fix
pin exact versions or ship a lockfile
INFOPrompt injectionprompt.authority_framing · SKILL.md:687
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
7. **Permission errors**: All API interfaces are controlled by EDA's permission system. If a specific API consistently fails to execute (returns error or null) while other APIs work fine, and you've c
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · guide/cli.md:1065
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. Always attach `--ext-uuid eda` to `invoke`, so that the full permission set is granted;
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 223be8c6e8ce · 20 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publishereasyeda GitHub organizationOwner of the repository this skill is read from
  • Source foldereasyeda/easyeda-api-skillThe exact folder we audited
  • LicenceNot declaredAs the repository states it
  • Commit pinned for this verdict223be8c6e8ceA new audit runs when the source changes
  • Repository statusNot archivedLast push 3 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: EasyEDA Pro API skill for AI agents. Use when working with EasyEDA Pro EDA software, including PCB design, schematic editing, footprint/symbol management, and project operations. Supports live debugging in EasyEDA and…

---
name: easyeda-api
description: >-
  EasyEDA Pro API skill for AI agents. Use when working with EasyEDA Pro EDA software,
  including PCB design, schematic editing, footprint/symbol management, and project operations.
  Supports live debugging in EasyEDA and EasyEDA extension development. Provides complete API
  reference (120+ classes, 62 enums, 70 interfaces), extension-development documentation, and a
  WebSocket bridge server to execute code in the running EasyEDA Pro client.
  Trigger on: "嘉立创EDA,启动!", "立创EDA,启动!", "EDA,启动!",
  "EasyEDA", "PCB", "schematic", "footprint", "EDA", "circuit board",
  "嘉立创EDA", "原理图", "PCB设计".
  **IMPORTANT**: 嘉立创EDA's English name is **EasyEDA**. They are the SAME product.
  Never use other transliterations like "EasyEDA Pro" (unless specifically versioned), "EASYEDA", "easyeda", etc. Always use "EasyEDA" for English references and "嘉立创EDA" for Chinese references.
license: MIT
compatibility: Requires Node.js 18+, EasyEDA Pro desktop client with extension support
metadata:
  author: JLCEDA
  version: "1.1.56"
  openclaw:
    requires:
      bins:
        - node
      env:
        - CLAUDE_SKILL_DIR
---

# EasyEDA Pro API Skill

Control EasyEDA Pro (嘉立创EDA专业版) programmatically through AI. This skill provides:

1. **Complete API reference** — 120 classes, 62 enums, 70 interfaces, 19 type aliases
2. **WebSocket bridge** — Execute code in the running EasyEDA Pro client
3. **Code patterns** — Common operations for PCB, schematic, library, and project management
4. **Document source format reference** — File format specifications for project, schematic, and PCB sources when users need to analyze or modify EasyEDA document source directly instead of using the API

This skill supports not only live debugging in EasyEDA, but also EasyEDA extension development.
During EasyEDA extension development, AI agents can use the extension-related documentation, API references, type information, usage examples, and bridge-based debugging capabilities provided by this skill to look up APIs, write code, and validate behavior during integration and debugging.

## Architecture

```
┌───────────┐   HTTP/WS     ┌─────────────────┐   WebSocket   ┌───────────┐
│ AI Agent  │ ◄───────────► │  Bridge Server  │ ◄───────────► │  EasyEDA  │
│           │  Port Range   │  (Node.js)      │  Port Range   │  (Client) │
└───────────┘  49620-49629  └─────────────────┘  49620-49629  └───────────┘
```

The server auto-selects an available port from 49620-49629 on startup.
Both AI and EDA clients auto-discover the server by scanning the port range
and verifying a handshake (`service: "easyeda-bridge"`).

## Quick Start

### 1. Command Triggers

When user says **"嘉立创EDA,启动!"**, **"立创EDA,启动!"**, or **"EDA,启动!"**:

**IMPORTANT: Session initialization** — Reply immediately with this exact text to set the correct session title:

```
📋 EasyEDA Session
```

Then proceed with the setup steps below.

### 2. Install dependencies (if needed)

```bash
cd ${CLAUDE_SKILL_DIR} && npm install
```

### 3. Start bridge server

> **⚠️ IMPORTANT**: The bridge server must run in the background. Do NOT run it in the foreground, or the AI will block waiting for the server to exit.

```bash
# Check if bridge is already running
for port in $(seq 49620 49629); do
  resp=$(curl -s http://localhost:$port/health 2>/dev/null)
  if echo "$resp" | grep -q '"easyeda-bridge"'; then
    echo "Bridge already running on port $port"
    BRIDGE_PORT=$port
    break
  fi
done

# Start bridge if not running
if [ -z "$BRIDGE_PORT" ]; then
  node ${CLAUDE_SKILL_DIR}/scripts/bridge-server.mjs &
  sleep 2
  # Find the port bridge is running on
  for port in $(seq 49620 49629); do
    resp=$(curl -s http://localhost:$port/health 2>/dev/null)
    if echo "$resp" | grep -q '"easyeda-bridge"'; then
      BRIDGE_PORT=$port
      break
    fi
  done
fi

echo "Bridge running on port: ${BRIDGE_PORT:-unknown}"
```

### 4. Connect EasyEDA

Install the `run-api-gateway.eext` extension in EasyEDA Pro. Download link:

- https://jlc-ext.com/item/oshwhub/run-api-gateway

After the extension is loaded, it will automatically establish the WebSocket connection.

### 5. Verify connection and select EDA window

```bash
# Check bridge and EDA connection status
curl http://localhost:${BRIDGE_PORT:-49620}/health

# List all connected EDA windows
curl http://localhost:${BRIDGE_PORT:-49620}/eda-windows
```

The `/eda-windows` response looks like:
```json
{
  "windows": [
    { "windowId": "abc-123", "connected": true, "active": true },
    { "windowId": "def-456", "connected": true, "active": false }
  ],
  "activeWindowId": "abc-123",
  "count": 2
}
```

**Handle based on window count**:
- **0 windows**: Tell user "No EasyEDA window is connected. Please ensure the EasyEDA extension (run-api-gateway.eext) is installed and loaded in EasyEDA. Download: https://jlc-ext.com/item/oshwhub/run-api-gateway"
- **1 window**: Auto-selected as active. Tell user: "✅ Connected! Active EDA window: abc-123. Ready to work."
- **2+ windows**: Show the available windows and ask user to select:
  ```
  Multiple EDA windows detected:
  - abc-123 (active)
  - def-456
  
  Which EDA window should I use?
  ```

**Select a window**:
```bash
curl -X POST http://localhost:${BRIDGE_PORT}/eda-windows/select \
  -H "Content-Type: application/json" \
  -d '{"windowId": "abc-123"}'
```

After selection, confirm: "✅ Active EDA window: abc-123. Ready to work."

### 6. Execute code on EDA

```bash
curl -X POST http://localhost:${BRIDGE_PORT:-49620}/execute \
  -H "Content-Type: application/json" \
  -d '{"code": "return await eda.dmt_Project.getCurrentProjectInfo();"}'
```

## API Documentation

The full API reference is in the [references/](references/) directory:

- [references/_index.md](references/_index.md) — Master index of all classes, enums, interfaces, and types
- [references/_quick-reference.md](references/_quick-reference.md) — All method signatures for rapid lookup
- `references/class

Excerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 223be8c

npm install
git clone --depth=1 https://github.com/easyeda/easyeda-api-sdk.git my-extension

Commands as the repository documents them: shown, never run by us. Our verdict covers commit 223be8c6e8ce only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
GitHub CopilotMentioned in its text, not testedSkills for GitHub Copilot · About GitHub Copilot
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 223be8c6e8ce

Similar skills

Questions about easyeda-api

What does the easyeda-api skill do?
嘉立创EDA专业版AI SKILL,为AI编程工具提供完整的EasyEDA Pro API接口和WebSocket桥接能力。EasyEDA Pro AI SKILL provides a complete EasyEDA Pro API interface and WebSocket bridging capability for AI programming tools.
Is easyeda-api safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can easyeda-api access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does easyeda-api work with?
Its documentation mentions claude-code, copilot, cursor and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (223be8c6e8ce), read on 2026-10-20. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.