Agent skill · Audited from source
easyeda-api
skill · easyeda/easyeda-api-skillLicence not declaredAudited 20 Oct 2026 · source 223be8c6e8ce
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 223be8c6e8ce and observed network access and no hard-coded secrets. The audit raised 8 findings, 2 critical or high. What it does: EasyEDA Pro API skill for AI agents. Use when working with EasyEDA Pro EDA software, including PCB design, schematic editing, footprint/symbol management, and project operations. Supports live debugging in EasyEDA and…
Cite
Cite this page
ModelsAtlas. “easyeda-api (easyeda/easyeda-api-skill)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/easyeda/easyeda-api
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 2 critical or high findings, starting with “Prompt injection” in SKILL.md:135. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared2 observations
- ShellNone observedNo commands run in the source
- DependenciesNot pinnedSome versions float
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | WARN | 3 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 4 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass, no license.
Findings (8)
HIGHPrompt injectionprompt.fetch_and_trust · SKILL.md:135
- **0 windows**: Tell user "No EasyEDA window is connected. Please ensure the EasyEDA extension (run-api-gateway.eext) is installed and loaded in EasyEDA. Download: https://jlc-ext.com/item/oshwhub/ru
- Why
- remote text is to be obeyed as instructions
- Fix
- —
HIGHPrompt injectionprompt.fetch_and_trust · SKILL.md:677
2. **EDA not connected?**: Ensure bridge extension is loaded in EasyEDA. Download: https://jlc-ext.com/item/oshwhub/run-api-gateway
- Why
- remote text is to be obeyed as instructions
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · SKILL.md:274
resp=$(curl -s http://127.0.0.1:$port/health 2>/dev/null)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · scripts/bridge-server.mjs:94
const req = httpGet(`http://127.0.0.1:${port}/health`, { timeout: 800 }, (res) => {- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
LOWSupply chainsupply.unpinned · package.json
ws
- Why
- 1 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
INFOPrompt injectionprompt.authority_framing · SKILL.md:687
7. **Permission errors**: All API interfaces are controlled by EDA's permission system. If a specific API consistently fails to execute (returns error or null) while other APIs work fine, and you've c
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · guide/cli.md:1065
1. Always attach `--ext-uuid eda` to `invoke`, so that the full permission set is granted;
- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 223be8c6e8ce · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishereasyeda GitHub organizationOwner of the repository this skill is read from
- Source foldereasyeda/easyeda-api-skillThe exact folder we audited
- LicenceNot declaredAs the repository states it
- Commit pinned for this verdict223be8c6e8ceA new audit runs when the source changes
- Repository statusNot archivedLast push 3 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: EasyEDA Pro API skill for AI agents. Use when working with EasyEDA Pro EDA software, including PCB design, schematic editing, footprint/symbol management, and project operations. Supports live debugging in EasyEDA and…
---
name: easyeda-api
description: >-
EasyEDA Pro API skill for AI agents. Use when working with EasyEDA Pro EDA software,
including PCB design, schematic editing, footprint/symbol management, and project operations.
Supports live debugging in EasyEDA and EasyEDA extension development. Provides complete API
reference (120+ classes, 62 enums, 70 interfaces), extension-development documentation, and a
WebSocket bridge server to execute code in the running EasyEDA Pro client.
Trigger on: "嘉立创EDA,启动!", "立创EDA,启动!", "EDA,启动!",
"EasyEDA", "PCB", "schematic", "footprint", "EDA", "circuit board",
"嘉立创EDA", "原理图", "PCB设计".
**IMPORTANT**: 嘉立创EDA's English name is **EasyEDA**. They are the SAME product.
Never use other transliterations like "EasyEDA Pro" (unless specifically versioned), "EASYEDA", "easyeda", etc. Always use "EasyEDA" for English references and "嘉立创EDA" for Chinese references.
license: MIT
compatibility: Requires Node.js 18+, EasyEDA Pro desktop client with extension support
metadata:
author: JLCEDA
version: "1.1.56"
openclaw:
requires:
bins:
- node
env:
- CLAUDE_SKILL_DIR
---
# EasyEDA Pro API Skill
Control EasyEDA Pro (嘉立创EDA专业版) programmatically through AI. This skill provides:
1. **Complete API reference** — 120 classes, 62 enums, 70 interfaces, 19 type aliases
2. **WebSocket bridge** — Execute code in the running EasyEDA Pro client
3. **Code patterns** — Common operations for PCB, schematic, library, and project management
4. **Document source format reference** — File format specifications for project, schematic, and PCB sources when users need to analyze or modify EasyEDA document source directly instead of using the API
This skill supports not only live debugging in EasyEDA, but also EasyEDA extension development.
During EasyEDA extension development, AI agents can use the extension-related documentation, API references, type information, usage examples, and bridge-based debugging capabilities provided by this skill to look up APIs, write code, and validate behavior during integration and debugging.
## Architecture
```
┌───────────┐ HTTP/WS ┌─────────────────┐ WebSocket ┌───────────┐
│ AI Agent │ ◄───────────► │ Bridge Server │ ◄───────────► │ EasyEDA │
│ │ Port Range │ (Node.js) │ Port Range │ (Client) │
└───────────┘ 49620-49629 └─────────────────┘ 49620-49629 └───────────┘
```
The server auto-selects an available port from 49620-49629 on startup.
Both AI and EDA clients auto-discover the server by scanning the port range
and verifying a handshake (`service: "easyeda-bridge"`).
## Quick Start
### 1. Command Triggers
When user says **"嘉立创EDA,启动!"**, **"立创EDA,启动!"**, or **"EDA,启动!"**:
**IMPORTANT: Session initialization** — Reply immediately with this exact text to set the correct session title:
```
📋 EasyEDA Session
```
Then proceed with the setup steps below.
### 2. Install dependencies (if needed)
```bash
cd ${CLAUDE_SKILL_DIR} && npm install
```
### 3. Start bridge server
> **⚠️ IMPORTANT**: The bridge server must run in the background. Do NOT run it in the foreground, or the AI will block waiting for the server to exit.
```bash
# Check if bridge is already running
for port in $(seq 49620 49629); do
resp=$(curl -s http://localhost:$port/health 2>/dev/null)
if echo "$resp" | grep -q '"easyeda-bridge"'; then
echo "Bridge already running on port $port"
BRIDGE_PORT=$port
break
fi
done
# Start bridge if not running
if [ -z "$BRIDGE_PORT" ]; then
node ${CLAUDE_SKILL_DIR}/scripts/bridge-server.mjs &
sleep 2
# Find the port bridge is running on
for port in $(seq 49620 49629); do
resp=$(curl -s http://localhost:$port/health 2>/dev/null)
if echo "$resp" | grep -q '"easyeda-bridge"'; then
BRIDGE_PORT=$port
break
fi
done
fi
echo "Bridge running on port: ${BRIDGE_PORT:-unknown}"
```
### 4. Connect EasyEDA
Install the `run-api-gateway.eext` extension in EasyEDA Pro. Download link:
- https://jlc-ext.com/item/oshwhub/run-api-gateway
After the extension is loaded, it will automatically establish the WebSocket connection.
### 5. Verify connection and select EDA window
```bash
# Check bridge and EDA connection status
curl http://localhost:${BRIDGE_PORT:-49620}/health
# List all connected EDA windows
curl http://localhost:${BRIDGE_PORT:-49620}/eda-windows
```
The `/eda-windows` response looks like:
```json
{
"windows": [
{ "windowId": "abc-123", "connected": true, "active": true },
{ "windowId": "def-456", "connected": true, "active": false }
],
"activeWindowId": "abc-123",
"count": 2
}
```
**Handle based on window count**:
- **0 windows**: Tell user "No EasyEDA window is connected. Please ensure the EasyEDA extension (run-api-gateway.eext) is installed and loaded in EasyEDA. Download: https://jlc-ext.com/item/oshwhub/run-api-gateway"
- **1 window**: Auto-selected as active. Tell user: "✅ Connected! Active EDA window: abc-123. Ready to work."
- **2+ windows**: Show the available windows and ask user to select:
```
Multiple EDA windows detected:
- abc-123 (active)
- def-456
Which EDA window should I use?
```
**Select a window**:
```bash
curl -X POST http://localhost:${BRIDGE_PORT}/eda-windows/select \
-H "Content-Type: application/json" \
-d '{"windowId": "abc-123"}'
```
After selection, confirm: "✅ Active EDA window: abc-123. Ready to work."
### 6. Execute code on EDA
```bash
curl -X POST http://localhost:${BRIDGE_PORT:-49620}/execute \
-H "Content-Type: application/json" \
-d '{"code": "return await eda.dmt_Project.getCurrentProjectInfo();"}'
```
## API Documentation
The full API reference is in the [references/](references/) directory:
- [references/_index.md](references/_index.md) — Master index of all classes, enums, interfaces, and types
- [references/_quick-reference.md](references/_quick-reference.md) — All method signatures for rapid lookup
- `references/classExcerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 223be8c
npm install git clone --depth=1 https://github.com/easyeda/easyeda-api-sdk.git my-extension
git clone https://github.com/easyeda/easyeda-api-skill git -C easyeda-api-skill checkout 223be8c6e8ce
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 223be8c6e8ce only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| GitHub Copilot | Mentioned in its text, not tested | Skills for GitHub Copilot · About GitHub Copilot |
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
223be8c6e8ce
Similar skills
affaan-m/ECC
Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing…
n8n-io/n8n
Fetch and display the full transcript from a Loom video URL. Use when the user wants to get or read a Loom transcript.
anthropics/skills
Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it…
Questions about easyeda-api
What does the easyeda-api skill do?
Is easyeda-api safe to install?
What can easyeda-api access on my machine?
Which assistants does easyeda-api work with?
How current is this page?
Sources
- github.com/easyeda/easyeda-api-skill — the audited source at commit 223be8c6e8ce and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the easyeda-api skill do?
- Is easyeda-api safe to install?
- What can easyeda-api access on my machine?