npu-torchair-infer
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a shell script
scripts/run_benchmark.shthat utilizescurlto fetch model configurations and weight files from a HuggingFace mirror repository. This is a standard practice for managing model assets in specific network environments. - [REMOTE_CODE_EXECUTION]: The benchmarking and inference scripts support a
--trust_remote_codeflag which is passed to the underlying model loading functions. This allows for the execution of custom architecture code defined in remote model repositories, a common requirement for specialized model architectures. - [COMMAND_EXECUTION]: The skill interacts with the local system to source the Ascend CANN toolkit environment via
set_env.shand executes benchmarking processes. These operations are restricted to the expected scope of configuring and running NPU-accelerated workloads. - [BENIGN_DYNAMIC_EXECUTION]: Static analysis identified the use of dynamic module loading in
scripts/benchmark.pyvia__import__. Upon review, this is used safely to programmatically check the versions of installed dependencies liketransformersfor environment reporting.
Audit Metadata