simulink-generate-embedded-code

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill executes code from a pre-compiled MATLAB P-file located at scripts/configure_for_codegen.p. This is a standard binary format for distributing MATLAB functions from this vendor and is treated as a safe vendor-owned resource.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes Simulink models (.slx files) which are untrusted external data sources provided by the user.
  • Ingestion points: Reads model files and associated data dictionaries (.sldd) through the configure_for_codegen function called in SKILL.md.
  • Boundary markers: The skill instructions provide constraints for the agent's behavior but do not define specific delimiters or "ignore instructions" markers for the processed model data.
  • Capability inventory: The skill uses evaluate_matlab_code to execute MATLAB scripts and generates C/C++ code and reports to the filesystem.
  • Sanitization: No explicit sanitization or validation of model content is mentioned in the skill instructions.
  • [COMMAND_EXECUTION]: The skill interacts with the MATLAB environment via the evaluate_matlab_code tool. The agent is strictly instructed to use an atomic wrapper function, minimizing the risk of arbitrary command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 12:03 PM
Security Audit — agent-trust-hub — simulink-generate-embedded-code