simulink-collect-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEOBFUSCATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The skill includes a pre-compiled MATLAB P-code file located at
scripts/AgentProgressMonitor.p. P-code is a standard MATLAB format that provides executable logic in an obfuscated binary form to protect intellectual property while allowing the script to run natively within the environment. - [DYNAMIC_EXECUTION]: The workflow involves adding the skill's script directory to the MATLAB path and instantiating the
AgentProgressMonitorclass. This mechanism dynamically loads and executes the logic contained in the pre-compiled helper file to provide real-time status updates during project artifact indexing. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and display data derived from external Simulink models and project artifacts, which constitutes an indirect injection surface.
- Ingestion points: Metric data, component names, and diagnostic messages are ingested via the
getMetricsandgetArtifactIssuesmethods inSKILL.mdandscripts/AgentProgressMonitor.p. - Boundary markers: The instructions for presenting results to the user do not include specific delimiters or boundary markers for the interpolated model metadata.
- Capability inventory: The skill has the capability to execute metric algorithms via
executeand write interactive reports to the file system usinggenerateReport. - Sanitization: The reference code for result inspection in
SKILL.mdoutputs component names and values directly from themetric.Resultobjects usingfprintfwithout explicit sanitization or filtering of the model-provided strings.
Audit Metadata