simulink-generate-embedded-code
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill executes code from a pre-compiled MATLAB P-file located at
scripts/configure_for_codegen.p. This is a standard binary format for distributing MATLAB functions from this vendor and is treated as a safe vendor-owned resource. - [INDIRECT_PROMPT_INJECTION]: The skill processes Simulink models (
.slxfiles) which are untrusted external data sources provided by the user. - Ingestion points: Reads model files and associated data dictionaries (
.sldd) through theconfigure_for_codegenfunction called inSKILL.md. - Boundary markers: The skill instructions provide constraints for the agent's behavior but do not define specific delimiters or "ignore instructions" markers for the processed model data.
- Capability inventory: The skill uses
evaluate_matlab_codeto execute MATLAB scripts and generates C/C++ code and reports to the filesystem. - Sanitization: No explicit sanitization or validation of model content is mentioned in the skill instructions.
- [COMMAND_EXECUTION]: The skill interacts with the MATLAB environment via the
evaluate_matlab_codetool. The agent is strictly instructed to use an atomic wrapper function, minimizing the risk of arbitrary command injection.
Audit Metadata