arduino-cli-skill

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions, examples, and a PowerShell script (scripts/workflow-windows.ps1) to execute arduino-cli commands for board discovery, compilation, and firmware uploading. These commands interact with the local filesystem and hardware serial ports.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process output from external CLI tools, creating a potential surface for indirect injection if tool output is maliciously crafted.
  • Ingestion points: Command output from arduino-cli and system discovery tools (Get-PnpDevice, ls /dev/) as described in references/serial-ports.md and SKILL.md.
  • Capability inventory: Shell command execution via arduino-cli and PowerShell/Bash scripts.
  • Boundary markers: None explicitly implemented to separate data from instructions.
  • Sanitization: The scripts do not explicitly sanitize variables like $SketchPath or $BoardFQBN, though they are used as parameters to the CLI tool.
  • [EXTERNAL_DOWNLOADS]: The skill references official documentation at https://arduino.github.io/arduino-cli/, which is a well-known service and the authoritative source for the tool described.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:31 PM