JLC EDA Drawing

• Analyzed: May 11, 2026, 1:16 PM
• Findings: 1
• Version: 0.1.0
• Hash: 51c8a3019fa3bc0521baf566bccfd61ec847f420e66fca5f2061ee70ecfa08df
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle includes a bridge server (`scripts/bridge-server.mjs`) that enables arbitrary JavaScript execution within a running EasyEDA client. This server is unauthenticated and uses permissive CORS headers ('*'), which creates a significant risk of unauthorized remote control or cross-site attacks against the EDA software. Additionally, `references/bridge-api.md` provides instructions to run this server in a hidden window on Windows. While these capabilities are aligned with the stated purpose of automating circuit design, the lack of security controls on the execution gateway constitutes a high-risk behavior.