KiCad PCB

v1.0.0

Automate PCB design with KiCad. Create schematics, design boards, export Gerbers, order from PCBWay. Full design-to-manufacturing pipeline.

2· 2.2k·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The name/description (KiCad automation, Gerber export, PCBWay ordering) aligns with the files and runtime behavior: the script creates projects, runs kicad-cli, exports Gerbers, packages ZIPs, and includes PCBWay-related commands. skill.json and SKILL.md consistently require kicad-cli and optional Python packages (cairosvg, pillow).
Instruction Scope
The SKILL.md stays on task: it instructs using kicad-cli, the included Python script, and a config file under ~/.kicad-pcb. It promises manual confirmation before ordering and currently requires manual upload to PCBWay. Note: SKILL.md and the script read/write files under the user's home (~/.kicad-pcb and ~/kicad-projects), which is expected for this purpose but worth understanding as the skill will create and modify those files.
Install Mechanism
There is no install spec (instruction-only with a bundled script). That minimizes supply-chain risk compared to remote fetch/install steps. The script relies on local KiCad and Python packages; installation instructions are standard and local.
Credentials
The skill declares no required environment variables or credentials, and the config file (~/.kicad-pcb/config.json) is used to store preferences (including a pcbway/email block). This is reasonable. One minor inconsistency: SKILL.md and commands mention PCBWay actions (pcbway-upload, pcbway-cart that require auth) but skill.json does not declare any credential requirement and SKILL.md does not specify how auth should be stored (env var vs config). Confirm how PCBWay credentials are handled before enabling any automated upload functionality.
Persistence & Privilege
always is false; the skill is user-invocable and may run autonomously per platform defaults. The script only writes its own config and project files in the user's home directory and does not appear to modify other skills or system-wide settings. This level of persistence and privileges is proportional to its purpose.
Assessment
This skill appears to do what it says: it creates KiCad projects, runs kicad-cli, generates Gerbers and ZIPs, and provides commands related to PCBWay. Before installing or running it, consider the following: - Inspect the full scripts: I reviewed a large portion but the provided source was truncated; review the complete scripts for any network calls, hidden endpoints, or credential-handling logic (look for requests, urllib, httpx, sockets, or subprocess calls that run curl/wget). - Understand where credentials go: PCBWay integration is mentioned. Currently SKILL.md says manual upload is required, but some commands indicate future/optional automated upload/cart placement. Confirm whether PCBWay authentication is stored in ~/.kicad-pcb/config.json (file on disk) or expected as environment variables, and prefer a manual flow or use temporary credentials if you are concerned. - Expect local file writes: the skill will create ~/.kicad-pcb/ and ~/kicad-projects/ and write project files and reports. Back up any important files and verify file locations if you have storage/permission concerns. - Run in a controlled environment first: if you are unsure about provenance (owner is unknown and repository/homepage are external), consider running the tool in a VM or isolated environment until you are comfortable. - Verify kicad-cli and dependencies are from trusted sources: install KiCad from the official site or your OS package manager. The Python dependencies are standard (pillow, cairosvg). If you want, I can further inspect the remaining (truncated) parts of scripts/kicad_pcb.py for any network or credential-handling code and re-evaluate the confidence level.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ff24wc3w3fgs1x7jnqgdmcx80dmdk

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments