registry / hi-aiot-skills / 1.0.0

hi-aiot-skills@1.0.0

Hi-AIoT Agent Skills 集合 — HiSilicon Hi3516CV610/CV608 嵌入式平台开发工具集

Static Scan Results

scanned 21d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 9.14 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-26json

2 "name": "hi-aiot-skills",

3 "version": "1.0.0",

4 "description": "Hi-AIoT Agent Skills 集合 — HiSilicon Hi3516CV610/CV608 嵌入式平台开发工具集",

5 "bin": {

6 "hi-aiot-cli": "cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src/",

11 "raw/"

12 ],

13 "scripts": {

14 "postinstall": "node src/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "keywords": [

17 "hisilicon",

18 "hi3516",

19 "embedded",

20 "agent-skills",

21 "claude-code",

22 "ai-tools"

23 ],

24 "license": "MIT"

25}

cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// hi-aiot-cli — Agent Skills 安装工具

3// CLI 入口：解析 setup/install/list 子命令及 -g/--target/--path 参数

5const fs = require('fs');

6const path = require('path'

raw/.agents/skills/hi3516cv610-burn-local/scripts/setup_pc_local.batView file

•path = raw/.agents/skills/hi3516cv610-burn-local/scripts/setup_pc_local.bat kind = payload_in_excluded_dir sizeBytes = 5198 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

raw/.agents/skills/hi3516cv610-burn-local/scripts/setup_pc_local.batView on unpkg

•path = raw/.agents/skills/hi3516cv610-burn-local/scripts/setup_pc_local.bat kind = build_helper sizeBytes = 5198 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

raw/.agents/skills/hi3516cv610-burn-local/scripts/setup_pc_local.batView on unpkg

raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView file

•path = raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx kind = high_entropy_blob sizeBytes = 212854 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg

•path = raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx kind = compressed_blob sizeBytes = 212854 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg

•path = raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx kind = nested_archive_needs_inspection sizeBytes = 212854 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

raw/.agents/skills/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.json

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code