Matlab Bridge

MATLAB桥接技能，用于调用MATLAB进行仿真计算、数据分析和绘图。支持直接执行MATLAB代码、运行.m脚本、数据交互。适用于结构试验数据处理、振动分析、有限元后处理等场景。

This skill appears to do what it says: it launches your local MATLAB to run code and save outputs. Before installing or using it, consider the following: - Only run trusted MATLAB code. The skill executes arbitrary MATLAB commands provided by the agent/user, so malicious or buggy MATLAB code can read/write files, run system commands (via MATLAB's system/web functions), or leak sensitive data in saved .mat/.csv files. - Confirm the output directory. SKILL.md and test scripts reference D:\Personal\OpenClaw\matlab-outputs\, while the bridge's default output directory is repository-relative (./matlab-outputs under the OpenClaw root). Decide where outputs should go and adjust parameters or code to avoid accidental overwrites of important files. - Consider running in a sandbox or with limited-privilege account if you will execute untrusted scripts (e.g., virtual machine, container, or separate user profile). - The skill requires a local MATLAB installation and valid license; it does not request cloud credentials or network access, but MATLAB itself can make network calls if your scripts use web APIs. - If you need stronger guarantees, inspect or modify the code to restrict allowed MATLAB operations (e.g., disallow system/web calls) or to redirect outputs to a safe directory. If you want me to point out exact lines to change to relocate the output directory or to add safeguards (e.g., disable save of workspace, sanitize incoming code), tell me which protection you prefer and I can produce concrete edits.

Type: OpenClaw Skill Name: matlab-bridge Version: 1.0.0 The skill provides a bridge to execute arbitrary MATLAB code and scripts using the subprocess module in matlab_bridge.py, which is a high-risk capability. While this functionality is aligned with the stated purpose of the skill, the lack of input sanitization and the ability to run arbitrary commands through the MATLAB batch interface create a significant attack surface for command injection. Additionally, the scripts contain hardcoded absolute file paths (e.g., 'D:\Personal\OpenClaw\matlab-outputs\'), which is unusual for a generic skill and suggests an environment-specific configuration. No evidence of intentional malice or data exfiltration was found, but the broad execution permissions warrant a suspicious classification.