registry / hi-aiot-skills / 1.3.2

hi-aiot-skills@1.3.2

Hi-AIoT Agent Skills 集合 — HiSilicon Hi3516CV610/CV608 嵌入式平台开发工具集

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 72.3 KB of source, external domains: gitcode.com

Source & flagged code

9 flagged

package.jsonView file

Lines 1-32json

2 "name": "hi-aiot-skills",

3 "version": "1.3.2",

4 "description": "Hi-AIoT Agent Skills 集合 — HiSilicon Hi3516CV610/CV608 嵌入式平台开发工具集",

5 "bin": {

6 "hi-aiot-cli": "cli.js"

7 },

8 "files": [

9 "cli.js",

10 "src/",

11 "raw/",

12 "README.md"

13 ],

14 "scripts": {

15 "postinstall": "node src/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L15

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L15

16 },

17 "keywords": [

18 "hisilicon",

19 "hi3516",

20 "embedded",

21 "agent-skills",

22 "claude-code",

23 "ai-tools"

24 ],

25 "repository": {

26 "type": "git",

27 "url": "https://gitcode.com/MousyCat/hi-aiot-skills.git"

28 },

29 "author": "MousyCat",

30 "license": "MIT"

31}

cli.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// hi-aiot-cli — Agent Skills 安装工具

3// CLI 入口：解析 setup / install skill / start / list 子命令及参数

5var fs = require('fs');

6var path = require('path');

Medium

Dynamic Require

raw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batView file

•path = raw/.[redacted]-burn-local/scripts/setup_pc_local.bat kind = payload_in_excluded_dir sizeBytes = 5198 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

raw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batView on unpkg

•path = raw/.[redacted]-burn-local/scripts/setup_pc_local.bat kind = build_helper sizeBytes = 5198 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

raw/.agents/skills/origin/hi3516cv610-burn-local/scripts/setup_pc_local.batView on unpkg

raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView file

•path = raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx kind = high_entropy_blob sizeBytes = 212854 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg

•path = raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx kind = compressed_blob sizeBytes = 212854 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsxView on unpkg

•path = raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx kind = nested_archive_needs_inspection sizeBytes = 212854 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

raw/.agents/skills/origin/spi-panel-bringup/assets/Hi3516CV610_PINOUT_CN.xlsx

src/remotes/gitcode.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = hi-aiot-skills@1.0.0 matchedIdentity = npm:aGktYWlvdC1za2lsbHM:1.0.0 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/remotes/gitcode.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node src/postinstall.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code