skills/ascend-ai-coding/awesome-ascend-skills/migration-ascend-torchnpu-skills-environment-setup/Gen Agent Trust Hub
migration-ascend-torchnpu-skills-environment-setup
Fail
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and execute code from various external sources, including a flagged malicious domain.
- Evidence: Suggests cloning repositories from
https://bgithub.xyz/user/repo.git, which is identified as a malicious/phishing URL by security scanners. - Evidence: Downloads driver and firmware binaries (
.runfiles) fromhiascend.comand executes them. - Evidence: Downloads Python wheel files from
download.pytorch.organdgitcode.comfor manual installation viapip. - [PRIVILEGE_ESCALATION]: The skill requires extensive administrative permissions to perform system-level changes.
- Evidence: Frequent use of
sudofor installation and configuration (sudo make install,sudo ./Ascend-hdk-xxx.run). - Evidence: Modifies system user groups and adds new users (
groupadd HwHiAiUser,useradd -g HwHiAiUser). - Evidence: Grants execution permissions to downloaded external binaries using
chmod +x. - [REMOTE_CODE_EXECUTION]: The skill uses a pattern of downloading remote scripts or binaries and immediately executing them with high privileges.
- Evidence:
chmod +x Ascend-hdk-xxx-npu-driver_linux-aarch64.run && ./Ascend-hdk-xxx-npu-driver_linux-aarch64.run --full --install-for-all. - [DYNAMIC_EXECUTION]: The skill instructs the user to compile complex software from source at runtime.
- Evidence: Instructions for cloning, configuring, and building FFmpeg from source (
./configure --enable-shared && make -j$(nproc) && sudo make install). - Evidence: Instructions for building OpenCV from source via
cmakeandmake. - [PERSISTENCE]: The skill modifies shell configuration files to ensure environment variables persist across sessions.
- Evidence: Appends environment setup commands to the user's profile (
echo "source /usr/local/Ascend/ascend-toolkit/set_env.sh" >> ~/.bashrc). - [COMMAND_EXECUTION]: The skill runs low-level system commands to manage kernel updates and hardware state.
- Evidence: Disables kernel updates on Ubuntu (
apt-mark hold linux-image-generic) and usesrebootto restart the system.
Recommendations
- AI detected serious security threats
- Contains 6 malicious URL(s) - DO NOT USE
Audit Metadata