ClawHub
Back to skill

Security audit

EasyEDA Agent

Security checks across malware telemetry and agentic risk

Overview

This is a powerful but coherent EasyEDA automation skill whose risky capabilities are mostly disclosed and tied to PCB design work.

Install only if you are comfortable trusting the external easyeda-agent CLI, daemon, and connector. Use it on intended EasyEDA projects/windows, keep backups or checkpoints before destructive actions, prefer dry-run and typed actions, avoid debug.exec_js unless explicitly needed, and review local ~/.easyeda-agent state or lint snapshots if your designs are confidential.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tainted flow: 'fn' from open (line 185, file read) → open (file write)

Medium
Category
Data Flow
Content
"staggerLabels": True, "offsetRange": [18, 80],
                                "offsetStep": 6, "minLabelGap": 12}}
            fn = f"/tmp/ac_{spec['page']}.json"
            json.dump(acspec, open(fn, "w"), ensure_ascii=False)
            rc, out, err = run(["sch", "autoconnect", "--spec", fn, "--json"], 600)
            res = jparse(out).get("result") or {}
            results = res.get("results") or res.get("connections") or []
Confidence
94% confidence
Finding
The script writes to `/tmp/ac_{spec['page']}.json` using untrusted `spec['page']` data without sanitization. An attacker who controls the spec can use path traversal sequences or predictable temporary-file races to overwrite unintended files writable by the current user, especially in multi-user environments.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes substantial capabilities including shell, file read/write, environment access, and network use, but does not declare permissions or present a constrained capability model. In this context, the skill also instructs users to install and operate a local CLI/daemon with external interaction enabled, which increases the blast radius because the agent can affect local files, execute commands, and interact with a live EasyEDA session.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The documented purpose focuses on EasyEDA automation, but the skill content also includes ancillary behaviors such as audit-log mining, local baseline/version handling, debug JavaScript execution against a live window, library write-back, BOM post-processing, and optional online part-ranking queries. This mismatch is dangerous because users may grant trust for PCB automation without realizing the skill can inspect local history, modify reference data, or run lower-level debug paths with broader access than expected.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The guidance tells the agent/operator to run a broad `pkill -f` against the Chrome DevTools MCP profile without a clear safety warning or tighter targeting. That can terminate active automation/browser instances sharing the profile, causing loss of unsaved work or disrupting other sessions, especially since the document itself notes multi-session/profile contention.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document instructs direct modification of EasyEDA extension data inside IndexedDB to hot-reload code, effectively bypassing normal installation/update controls. This is dangerous because a mistake or maliciously altered procedure can corrupt the local extension state or inject arbitrary extension code into the EasyEDA/browser context with little guardrail.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This repeats the force-kill troubleshooting pattern for reclaiming the shared Chrome profile, again without a prominent warning about terminating browser processes. In context, the profile is shared across tools/sessions, so indiscriminate killing can disrupt concurrent users and destroy in-progress browser-backed editing or automation state.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation instructs users to replace already-placed schematic parts and notes that rewiring may be needed, but it does not prominently require confirmation, backups, or a clear warning that pin mappings and electrical behavior can change. In an EDA automation skill, this can cause unintended net changes, broken connectivity, or incorrect BOM/manufacturing outputs if used incautiously on an existing design.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly states that `zone-arrange --apply` may exit non-zero while electrical/positional changes have already been saved and will not be rolled back. In an automation skill that operates on live schematic state, this is dangerous because an agent or user may treat a failed command as non-mutating and then continue with retries or compensating actions, compounding unintended design corruption.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script persists full schematic snapshots to a local baseline directory and optionally versions them in git, but it does not provide any explicit warning, confirmation, or redaction step before saving project data. In this skill context, the captured layout may include proprietary design details, part selections, and internal project metadata, so silent persistence increases the risk of unintended retention or disclosure on shared machines or in backups.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The module exposes delete helpers that can remove components, wires, and flags immediately without any confirmation, dry-run, scope restriction, or undo guard in the wrapper. In an agent-driven automation context, a mistaken or manipulated call can cause destructive integrity loss to a user's schematic/PCB project.

Self-Modification

High
Category
Rogue Agent
Content
name: easyeda-agent
description: "Community EasyEDA Agent automation skill for EasyEDA Pro schematic and PCB work through the local easyeda-agent CLI/daemon/connector. Use when designing a board from scratch; inspecting, cleaning up, or safely refactoring an existing wired schematic; arranging multi-page functional modules; drawing page-scoped module frames and text labels; preserving and reconciling pin-to-net topology; placing/wiring real LCSC/JLC library parts; syncing schematic changes into PCB; laying out PCB components; running EasyEDA DRC/check/bridge-check/layout-lint; exporting BOM/netlists/artifacts; querying the embedded circuit-block library (`easyeda blocks ls/show/search`); or applying the bundled EasyEDA design workflows and conventions. 覆盖嘉立创EDA专业版原理图/PCB、混乱原理图整理、多页功能分区、框选文字标注、布线、铺铜、板框与机械门禁。适用于嘉立创EDA(JLC EDA / JLCEDA / LCEDA / EasyEDA Pro)与立创商城(LCSC)元件的电路板设计自动化。"
license: MIT
compatibility: "Requires the local easyeda-agent CLI and daemon (macOS/Linux/Windows) plus the EasyEDA Agent Connector extension installed in EasyEDA Pro with 'Allow external interaction' enabled. Bundled scripts need Python 3. Network access is needed only for LCSC part lookup and self-update."
metadata:
  author: zhoushoujianwork
  version: "1.2.10"
Confidence
95% confidence
Finding
The skill explicitly supports self-update of the CLI and skill directory and promotes installation via a remote curl-piped shell script. Even though it mentions sha256 verification for updates, this remains a high-risk supply-chain pattern because remote code or binaries can be fetched and executed or replaced locally, especially when combined with shell access and user instructions to enable external interaction in EasyEDA.

Session Persistence

Medium
Category
Rogue Agent
Content
- `schematic.page.clear` — **一键清空当前页**:删除所有页级 primitive(组件、网络标志/端口/标签、导线、总线、图形),默认保留图框 sheet(`--no-preserve-sheet` 连图框一起删)。`--dry-run` 只统计不删。返回各类型删除计数 `{deleted:{...}, total, deletedIds}`。**无 undo**,确认门控。生成→检测→清页→重试闭环用这个。生产流程必须先 dry-run、报告、等用户确认;清完再读回确认 sheet 仍在。CLI:`easyeda sch clear [--dry-run] [--no-preserve-sheet]`。
- `schematic.primitives.delete` — 按 id **跨类型**删除(组件/标志/导线/总线/图形都行),省略 `--ids` 则删当前选区(配合 `schematic.select` 做"全选→删除")。无 undo,确认门控。CLI:`easyeda sch prim-delete [--ids id1,id2]`(CSV,重复 id 自动去重——平台对含重复 id 的批次整批静默拒)。**图框守卫(2026-08-17 误删实锤)**:sheet 图元在 `sch list` 里是「无位号 @(0,0)」——与 PARTIAL 残件同脸,曾被残件清理误删,而平台没有重建图框的 API(丢了只能人工 UI 重放)。`prim-delete` 发送前自动比对活画布,命中 sheet 即拒;确认要删图框加 `--allow-sheet`。**清理残件前先看 componentType,别只看「无位号 + 原点坐标」**。**计数是回读验证出来的,不是请求数(#164)**:删完重新枚举各类目,`deleted`/`total` 只计真正消失的;有图元活下来则 `result.partial:true` + `survived`(按类目列 id),CLI **非零退出**。此前它把请求数当删除数上报,于是「删旧+重画」的 zone-draw 标签每轮都报干净、实则只加不减(P5 累积到 56 个)。**批量删不可靠已在工具内兜底(缺陷 3 已修)**:平台对大批量 delete 会静默 no-op 仍返 true(真机:zone-draw 批删旧框 survived=4、block-apply 回滚 deleted=false,**逐个删 100% 成功**)——zone-draw 删旧框/绘制回滚与 block-apply 回滚现已统一为「逐个删+回读证实+幸存者重试一次」,判定只信回读;agent 手工清理大批 id 时也照此办理:分小批或逐个 `prim-delete`,非零退出(partial)就按 survived 列表重试。**删组成员自动级联清组注册(缺陷 2 已修)**:`prim-delete` 删掉的器件若登记在虚拟组里,回读证实后自动从组注册表摘除(组删净则删组),不再留陈旧注册吃掉复用位号。**删除走通用图元类(#164 已修)**:`eda.sch_PrimitiveText.delete()` 只从内存/渲染索引摘除、**从不进持久化模型** —— 删完立即读=0、`sch save` 后=0,`doc reload` 后**原 id 全部复活**(矩形/导线不受影响,只有文本;文本的 `modify` 同样被丢弃,等于一经创建就冻结)。现已统一改走 `eda.sch_PrimitiveObject.delete(ids)`(跨类型、真落盘),`sch prim-delete` 与 `sch zone-draw --clear` 都已真机验过 reload 后归零。**幸存者会先 settle 复核一轮再定案(2026-08-19)**:连接器的存活判定是删完**立刻** `getAll()` 的,那一读可能采到尚未落定的快照 → 误报 `survived`,而 CLI 据此非零退出、人再删一遍空转。现在首轮报 partial 时,CLI 等一拍(400ms)对**幸存 id**重发一次删除,用第二次回执定案:已经没了 → 归 `notFound`、命令绿;真没删掉 → 照样非零退出并给出「`sch save` + 完全重启 EasyEDA」的 wedge 处方(stdout 上留的仍是**首轮**原始回执,最终判定看 stderr 与退出码)。**留下的判据教训**:立即回读**证明不了持久化**,凡是判断"删干净没有",判据是 `doc reload` 后再 `sch text-list`——这条对任何自研的 fail-closed 校验
...[truncated 26 chars]
Confidence
88% confidence
Finding
The skill persists workflow/group state under `~/.easyeda-agent/workflow/<project>.json`, creating cross-session retained state outside the live EasyEDA document. Persistent local state can become stale, be tampered with by other local processes, or leak project structure/metadata across runs, which is risky for an automation agent that may make destructive moves based on that cached state.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**默认自带 verify 复合流程(#121)**:清 → save → `doc reload` → 二遍清 → 最终 dry-run 计数——
  部分图元只在 save/reload 时被引擎物化,单次 handler 调用内任何枚举(含 #112 的循环)都看不到
  (R2 实测 reload 后冒出 3 条轨);返回 `{pass1, pass2, remainingAfterVerify, verified}`,
  `remainingAfterVerify` 非零 = 锁定/保留件或更深的引擎问题,绝不假报干净。`--no-verify` 回到
  单遍(快,但你要自己 reload 后 `--dry-run` 复查)。
  ⚠️ **破坏性**:生产流程必须**先 `--dry-run` 报告删除计数、等用户确认**,再执行。
  生成→检测→清板→重试闭环用这个。
Confidence
92% confidence
Finding
The documented `--no-verify` option disables the safeguard that performs save/reload/recheck after destructive board-clearing operations, even though the same text admits some primitives only materialize after reload. In a local design-automation agent, this can cause false assumptions that a board is clean and lead to silent persistence of copper, vias, or other PCB artifacts, creating integrity and safety risks in downstream manufacturing or refactoring workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/tests/run.py:130