registry / AI-agent control-surface risk / hi-aiot-skills
hi-aiot-skills
Hi-AIoT Agent Skills 集合 — HiSilicon Hi3516CV610/CV608 嵌入式平台开发工具集
This report shows the evidence for hi-aiot-skills@1.2.0. 1 of 3 known versions is blocked or flagged. The newest version, 1.3.2, is flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package does not show credential theft, exfiltration, persistence, or destructive behavior, and scanner blob findings are package-aligned skill assets. However, the npm lifecycle hook performs unconsented AI-agent control-surface mutation by staging bundled .agents skills at install time, which is a blocking policy violation. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm install of hi-aiot-skills@1.2.0
Impact
Unconsented installation of agent skill instructions/scripts into a user-level AI-agent staging area
Mechanism
postinstall copies bundled AI-agent skills into ~/.config/hi-aiot-cli/.agents
Policy narrative
On npm install, package.json runs src/postinstall.js, which calls setup() and copies raw/.agents into ~/.config/hi-aiot-cli/.agents. That writes AI-agent skill content and helper scripts into a user-level control surface before the user invokes the CLI. Later CLI commands can install those staged skills into project or tool-specific .agents directories; remote GitCode cloning is only user-invoked.
AI rationale
The package does not show credential theft, exfiltration, persistence, or destructive behavior, and scanner blob findings are package-aligned skill assets. However, the npm lifecycle hook performs unconsented AI-agent control-surface mutation by staging bundled .agents skills at install time, which is a blocking policy violation. Product guard normalized a concrete AI-agent control hijack publish_block to the blockable dangerous-capability shape.
Evidence
package.jsonsrc/postinstall.jssrc/install.jscli.jssrc/remotes/gitcode.jsraw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batraw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx~/.config/hi-aiot-cli/.agents~/.config/hi-aiot-cli/.agents/skills/origin/*
Network endpoints1
gitcode.com/<owner>/<repo>.git
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 86.0% confidence with low false-positive risk.
Evidence for policy risk
- src/postinstall.js automatically calls setup() during npm install.
- src/install.js setup copies raw/.agents into ~/.config/hi-aiot-cli/.agents without consent beyond install.
- cli.js start can copy staged .agents skills into current project/AI tool dirs when user invokes it.
Evidence against
- No credential/env harvesting found in inspected JS entrypoints.
- Network use is limited to user-invoked hi-aiot-cli install skill --gitcode via git clone to gitcode.com.
- Bundled .bat/.sh/.py/xlsx files are skill assets/examples for HiSilicon workflows, not executed by postinstall.
- Dynamic require in cli.js only loads local ./src/interactive during list -i.
Behavioral surface
ChildProcessDynamicRequireFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node src/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node src/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli.jsView file
4L5: var fs = require('fs');
L6: var path = require('path');
Medium
raw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batView file
•path = raw/.[redacted]-burn-local/scripts/setup_pc_local.bat
kind = payload_in_excluded_dir
sizeBytes = 5198
magicHex = [redacted]
High
Payload In Excluded Dir
Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.
raw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batView on unpkg•path = raw/.[redacted]-burn-local/scripts/setup_pc_local.bat
kind = build_helper
sizeBytes = 5198
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
raw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batView on unpkgraw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView file
•path = raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx
kind = high_entropy_blob
sizeBytes = 212854
magicHex = [redacted]
High
Ships High Entropy Blob
Package ships high-entropy non-source blobs.
raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg•path = raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx
kind = compressed_blob
sizeBytes = 212854
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg•path = raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx
kind = nested_archive_needs_inspection
sizeBytes = 212854
magicHex = [redacted]
Low
Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkgsrc/remotes/gitcode.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = hi-aiot-skills@1.0.0
matchedIdentity = npm:aGktYWlvdC1za2lsbHM:1.0.0
similarity = 0.400
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version.
src/remotes/gitcode.jsView on unpkgFindings
1 Critical3 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltasrc/remotes/gitcode.js
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobraw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx
HighPayload In Excluded Dirraw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.bat
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirecli.js
MediumShips Build Helperraw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.bat
MediumShips Compressed Blobraw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionraw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx
Affected versions and remediation
This report applies to hi-aiot-skills@1.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing hi-aiot-skills@1.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.