matlab-build-industrial-hmi
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is authored by MathWorks, which is a trusted organization. All external URL references point to official mathworks.com domains for licensing and documentation.
- [SAFE]: The skill enforces industrial safety best practices to prevent accidental equipment damage, such as requiring two-step confirmation dialogs (
uiconfirm) for all writes, displaying explicit range limits for setpoints, and providing visual feedback (flash indicators) for all actuation attempts. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external industrial servers, which represents a potential attack surface for indirect prompt injection if those sources were compromised.
- Ingestion points: Untrusted data enters via protocol-specific listeners such as
onDataChangefor OPC UA,onMessagefor MQTT, and polling timers for Modbus and PI Asset Framework, as detailed inreferences/protocol-cheatsheet.mdandreferences/pi-af-cheatsheet.md. - Boundary markers: The skill uses strict property-to-widget mapping and release-aware capability checks (
AccessLevelCurrent) to maintain clear boundaries between external data and the application state. - Capability inventory: The generated code has the capability to perform network writes (
writeValue,write) and execute method nodes (invoke) on industrial equipment. - Sanitization: The skill mitigates risks by requiring explicit data validation and sanitization, including the use of
jsondecodefor structured payloads,str2doublefor numeric coercion, andisnanguards to filter out malformed or malicious inputs before they affect the system.
Audit Metadata