matlab-connect-arduino

Pass

Audited by Gen Agent Trust Hub on Aug 2, 2026

Risk Level: SAFE
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill dynamically assembles MATLAB commands using the arduino() function based on user-selected ports, board types, and library names. This is standard behavior for hardware interfacing skills.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external hardware ports through the arduinolist and serialportlist commands. This represents a potential injection surface if a connected device were to present a malicious name; however, the skill strongly mitigates this by instructing the agent to never auto-select and to wait for user confirmation.
  • Ingestion points: arduinolist and serialportlist commands in SKILL.md.
  • Boundary markers: Explicit instructions to "Ask the user to select board," "Never auto-select a board," and "Never assume. Always ask the user before proceeding."
  • Capability inventory: The skill uses the evaluate_matlab_code tool to interact with the environment.
  • Sanitization: None performed on the strings returned from the system, relying instead on human-in-the-loop verification.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 2, 2026, 12:12 PM
Security Audit — agent-trust-hub — matlab-connect-arduino