matlab-install-products
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the MATLAB Package Manager (mpm) and installation templates from mathworks.com.
- [COMMAND_EXECUTION]: Executions include shell commands such as mkdir, curl, and chmod, as well as the mpm installer itself.
- [DYNAMIC_EXECUTION]: The skill uses the Write file tool to generate temporary PowerShell scripts and installation input files at runtime.
- [PRIVILEGE_ESCALATION]: Administrative privileges are requested on Windows via Start-Process -Verb RunAs, and PowerShell scripts are run with ExecutionPolicy Bypass.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data. 1. Ingestion points: User-provided release, destination path, and product list (SKILL.md). 2. Boundary markers: No explicit delimiters or safety instructions are used to wrap interpolated user data. 3. Capability inventory: Execution of PowerShell scripts, mpm installer, and shell commands (mkdir, curl, sed) across all platforms. 4. Sanitization: PowerShell scripts utilize [Regex]::Escape(), but Linux/macOS shell scripts interpolate product names directly into sed commands.
Audit Metadata