Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Jlceda Plugin Builder

v0.1.0

AI Skill for building EasyEDA Pro extension plugins. Used when users need to create, modify, or debug JLCEDA/EasyEDA Pro plugins, including generating plugin...

0· 130·0 current·0 all-time
byJasonYANG17@jasonyang170

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jasonyang170/extension-dev-skill.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Jlceda Plugin Builder" (jasonyang170/extension-dev-skill) from ClawHub.
Skill page: https://clawhub.ai/jasonyang170/extension-dev-skill
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install extension-dev-skill

ClawHub CLI

Package manager switcher

npx clawhub@latest install extension-dev-skill
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description match the instructions (plugin development for EasyEDA Pro). However SKILL.md and AGENTS.md both insist the authoritative index.d.ts is bundled and must be searched for API verification, yet the provided file manifest does not include index.d.ts. Asking the agent to read a file that isn't bundled is an incoherence: either the skill expects access to workspace files outside the skill bundle, or the package is incomplete.
Instruction Scope
Runtime instructions are narrowly scoped to building/modifying EasyEDA plugins and specify concrete safe alternatives to forbidden browser APIs. They instruct the agent to run searches (grepSearch), read files (readFile), clone public GitHub repos, and use npm build steps — all reasonable for a dev skill. The unusual constraint 'always search the bundled index.d.ts; do not look in node_modules' is restrictive and conflicts with the missing index.d.ts, which could cause unexpected behavior or force the agent to access other workspace files.
Install Mechanism
Instruction-only skill with no install spec and no code files to execute. This is low risk from an installation perspective; operations that modify disk (git clone, npm install, build) are invoked only as explicit workflow steps, not as an automatic installer.
Credentials
The skill requests no environment variables, no credentials, and no config paths. All recommended operations (git clone public repos, npm) are proportional to a plugin-development skill.
Persistence & Privilege
always:false and no special persistence or cross-skill configuration changes are requested. The skill allows normal autonomous invocation (platform default), which is not by itself a red flag; combined with the earlier inconsistency it warrants caution but not a privilege concern.
What to consider before installing
This skill appears to be a focused EasyEDA Pro extension development helper, but before installing or using it you should: 1) Verify whether an index.d.ts file (the skill repeatedly cites it as authoritative) is actually included or available in your workspace — the provided package does not list it. If it is missing, ask the skill author or include a trusted index.d.ts from the official @jlceda/pro-api-types package. 2) Inspect/confirm the external GitHub repositories the skill may clone or recommend (pro-api-sdk, extension-dev-mcp-tools) before allowing the agent to run git clone / npm install / npm run build. 3) Be aware the skill will read project files (extension.json, code, type definitions) and may run build/debug tools — do not run it in a workspace containing secrets or credentials. 4) If you plan to allow autonomous operation, prefer supervised mode until you validate its behavior (especially because of the missing index.d.ts). If the author cannot explain the missing type file or provide a trusted source for it, treat the package as incomplete and do not run automated builds.

Like a lobster shell, security has layers — review code before you run it.

latestvk972dkha4j9z9cr88jpetged7d83e6cx
130downloads
0stars
1versions
Updated 1mo ago
v0.1.0
MIT-0

JLCEDA Plugin Builder

Build extension plugins for EasyEDA Pro. Provides a complete API query workflow, code generation standards, and debugging toolchain.

Core Principles

  1. Never guess APIs — Check the Skill's index.d.ts first; if not found = does not exist
  2. Verify class existence before use — Search class name with grepSearch; no results = do not use
  3. Verify API mount path — The class where a method is defined ≠ the property it's mounted on under eda
  4. Verify return type methods — Different methods on the same class may return completely different interface types
  5. Browser APIs are forbidden in the main process — Cannot use localStorage, window, document; allowed inside iframe
  6. Document type values — SCH=1, PCB=3, FOOTPRINT=4 (PCB is not 2)

When to Use

Applicable:

  • Creating or modifying EasyEDA Pro extension plugins
  • Querying API method signatures in @jlceda/pro-api-types
  • Configuring extension.json, locales i18n files, or build processes
  • Automating plugin import/debugging via eext-dev-mcp MCP tools

Not applicable:

  • General TypeScript/JavaScript questions unrelated to EasyEDA Pro
  • Non-EasyEDA Pro EDA tools
  • Workspace has no extension.json and user did not request initialization

API Query Workflow (Four Steps)

API type definition location: the index.d.ts file bundled with this Skill (sourced from @jlceda/pro-api-types). Always search in this file; do not look in node_modules.

Step 1: Find the Correct Class

grepSearch "SCH_PrimitiveComponent"   # Schematic component class
grepSearch "PCB_PrimitiveVia"         # PCB via class

Step 2: Verify the Class Is Mounted on the eda Object

grepSearch "sch_PrimitiveComponent:"  # Note the colon
grepSearch "dmt_SelectControl:"       # Verify mount path

Step 3: Find the Method and Confirm Its Signature

grepSearch "getCurrentDocumentInfo"

Then use readFile to read the full signature and confirm parameter types and return type.

Step 4: Verify the Return Interface Has the Required Methods

# Search the returned interface type to confirm it has the needed methods
grepSearch "ISCH_PrimitiveComponent$1"  # Interfaces with $1 suffix usually have more methods

No search results = does not exist. Do not use!

Execution Workflow

  1. Plan — Understand requirements, confirm target editor (home/sch/pcb) and core functionality
  2. Init — If workspace is not initialized, run project initialization; otherwise skip
  3. Query — Dynamically query required APIs (four-step method); every API must be verified
  4. Validate — Verify all type signatures are complete with no guesswork; if uncertain, return to Query
  5. Confirm — Present implementation plan to user (API list, dependencies, data flow, file changes); wait for confirmation in Supervised mode. In Autopilot mode, skip this step for straightforward changes; only pause for complex or destructive operations
  6. Execute — Generate code; each API call corresponds to a verified signature, wrapped in try/catch
  7. Check — Check runtime environment constraints; confirm no forbidden operations; if violations found, return to Execute to fix

API Verification Checklist (Required Before Using Any API)

  • grepSearch found the method name; confirmed return type
  • readFile read the full signature; confirmed all parameter types and counts
  • Confirmed eda.xxx_YYY class exists in the class EDA property list
  • Confirmed API is mounted on the correct module
  • Verified the returned interface type also has the required methods
  • If using getAllPrimitiveId, must use a concrete type (not an abstract class)
  • Document type checks use the correct documentType values

Runtime Environment Constraints

Requirement❌ Forbidden✅ Recommended
Get user input-eda.sys_Dialog.showInputDialog()
User selection-eda.sys_Dialog.showSelectDialog()
Show messagealert()eda.sys_Dialog.showInformationMessage()
Confirm actionconfirm()eda.sys_Dialog.showConfirmationMessage()
Toast notificationDOM manipulationeda.sys_Message.showToastMessage()
Store datalocalStorage (main process)eda.sys_Storage.setExtensionUserConfig(key, value)
Custom UIManipulate host DOMeda.sys_IFrame.openIFrame()
Show HTMLshowInformationMessage(html)Must use iframe
Open linkwindow.open()eda.sys_Window.open()
Browser hardware APIUse in main processAvailable in iframe (navigator.serial, etc.)
IFrame data passing(window as any).__xxx = data (main process and iframe window are isolated); window.parent.eda✅ Option A (recommended): Store with eda.sys_Storage.setExtensionUserConfig(key, value), read in iframe with getExtensionUserConfig(key); ✅ Option B: Call eda API directly from iframe (both main process and iframe can access the eda object; just use eda directly)

Project Initialization

When extension.json does not exist in the workspace:

git clone https://github.com/easyeda/pro-api-sdk.git <project-name>
cd <project-name>
npm install
npm run compile

Failure Strategies

  • API does not exist: Stop immediately, inform the user
  • Signature uncertain: Stop generation, return to query step
  • Workspace not initialized: Prompt user to initialize first
  • Forbidden DOM API used: Automatically replace with eda.sys_* alternatives
  • Menu ID conflict: Automatically add prefix to differentiate (e.g., my-plugin-home, my-plugin-sch)

References

  • Complete API module list, enum definitions → resources/api-reference.md
  • Common pitfalls and lessons learned → resources/experience.md
  • MCP tool documentation → "MCP Tools" section in resources/api-reference.md

Comments

Loading comments...