matlab-discover-hardware
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
evaluate_matlab_codetool to perform hardware discovery tasks. This execution is limited to specific, verified helper functions bundled with the skill, ensuring that MATLAB interaction remains within the intended scope of discovering and inspecting connected devices. - [DYNAMIC_EXECUTION]: Implementation logic is provided via MATLAB P-code files (
.pextension), which are an opaque, pre-parsed executable format. This is a standard vendor practice for distributing MATLAB functionality. The skill also performs a controlled path modification usingaddpathto include its internal scripts during initialization, which is restricted by instructions to occur only once. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes user-provided strings for device names and hardware capabilities.
- Ingestion points: Parameters like
deviceNameandCapabilityare ingested from user input inSKILL.md. - Boundary markers: The instructions mandate structured execution patterns and specific helper functions to maintain tool execution boundaries.
- Capability inventory: The skill is capable of executing arbitrary MATLAB code through the
evaluate_matlab_codetool, though it is instructed to use only provided helpers. - Sanitization: Data sanitization and input validation are handled internally by the bundled MATLAB helper functions.
Audit Metadata