What did Sigil's automated scan find in easyeda-agent?

easyeda-agent was flagged as CRITICAL RISK (risk score 95) with 10 findings detected across 53 files. Review the findings before installing.

What security issues were found in easyeda-agent?

Sigil detected 10 findings in easyeda-agent, including patterns related to install_hooks, code_patterns, network_exfil. See the full scan report for details.

Scans/clawhub/easyeda-agent

easyeda-agent

clawhub

Summary

easyeda-agent v1.1.1 was classified as CRITICAL RISK with a risk score of 95. Sigil detected 10 findings across 53 files, covering phases including install hooks, code patterns, network exfiltration. Review the findings below before installing this package.

Package description: Community EasyEDA Agent automation skill for EasyEDA Pro schematic and PCB work through the local easyeda-agent CLI/daemon/connector. Use when designing a board from scratch; inspecting, cleaning u...

CRITICAL RISK(95)

v1.1.1

4 September 2026, 08:02 UTC

by Sigil Bot

Risk Score

Findings

Files Scanned

Provenance

Registry

https://clawhub.com/skills/easyeda-agent

Scanned From

https://clawhub.ai/api/v1/download?slug=easyeda-agent&version=1.1.1

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

SKILL.md:24

> ```
> curl -fsSL https://raw.githubusercontent.com/zhoushoujianwork/easyeda-agent/main/install.sh | sh
> ```

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/easyeda-agent)](https://sigilsec.ai/scans/D3BDAFB0-C338-401A-AE26-FF7DFEF3ECEC)

HTML

<a href="https://sigilsec.ai/scans/D3BDAFB0-C338-401A-AE26-FF7DFEF3ECEC"><img src="https://sigilsec.ai/badge/clawhub/easyeda-agent" alt="Sigil Scan"></a>

Run This Scan Yourself