npu-torchair-infer

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes a shell script scripts/run_benchmark.sh that utilizes curl to fetch model configurations and weight files from a HuggingFace mirror repository. This is a standard practice for managing model assets in specific network environments.
  • [REMOTE_CODE_EXECUTION]: The benchmarking and inference scripts support a --trust_remote_code flag which is passed to the underlying model loading functions. This allows for the execution of custom architecture code defined in remote model repositories, a common requirement for specialized model architectures.
  • [COMMAND_EXECUTION]: The skill interacts with the local system to source the Ascend CANN toolkit environment via set_env.sh and executes benchmarking processes. These operations are restricted to the expected scope of configuring and running NPU-accelerated workloads.
  • [BENIGN_DYNAMIC_EXECUTION]: Static analysis identified the use of dynamic module loading in scripts/benchmark.py via __import__. Upon review, this is used safely to programmatically check the versions of installed dependencies like transformers for environment reporting.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 06:56 AM
Security Audit — agent-trust-hub — npu-torchair-infer