STM32 CubeMX

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used with the wrong project path, the workflow could delete the wrong build folder or regenerate files unexpectedly.

Why it was flagged

The skill documents local shell commands that delete a build directory and run a build. This is purpose-aligned for STM32 project generation, but incorrect paths could remove or change local project files.

Skill content

rm -rf build/Debug
cmake --preset Debug
cmake --build build/Debug

Recommendation

Confirm PROJECT_DIR and IOC_FILE before running commands, keep the project under version control, and review generated changes before committing or flashing firmware.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users must independently ensure they are using a legitimate STM32CubeMX installation and compatible build tools.

Why it was flagged

The skill has no declared source/homepage and does not declare the external binaries its instructions rely on, even though the workflow expects local STM32CubeMX and build tools.

Skill content

Source: unknown
Homepage: none
Required binaries (all must exist): none

Recommendation

Install STM32CubeMX from STMicroelectronics or another trusted source, verify tool paths manually, and treat the skill as documentation rather than a vetted installer.