arduino-cli-skill
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions, examples, and a PowerShell script (
scripts/workflow-windows.ps1) to executearduino-clicommands for board discovery, compilation, and firmware uploading. These commands interact with the local filesystem and hardware serial ports. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process output from external CLI tools, creating a potential surface for indirect injection if tool output is maliciously crafted.
- Ingestion points: Command output from
arduino-cliand system discovery tools (Get-PnpDevice,ls /dev/) as described inreferences/serial-ports.mdandSKILL.md. - Capability inventory: Shell command execution via
arduino-cliand PowerShell/Bash scripts. - Boundary markers: None explicitly implemented to separate data from instructions.
- Sanitization: The scripts do not explicitly sanitize variables like
$SketchPathor$BoardFQBN, though they are used as parameters to the CLI tool. - [EXTERNAL_DOWNLOADS]: The skill references official documentation at
https://arduino.github.io/arduino-cli/, which is a well-known service and the authoritative source for the tool described.
Audit Metadata