Skills/ClawHub/embedded-driver-templates

embedded-driver-templates@1.0.1

CAUTION· static only

Publisher claims: "预验证驱动模板与外设初始化顺序查询工具——算法层纯 C99 平台无关，平台差异全部收在 port 适配层（示例给 STM32 HAL，dht11 另附 Arduino 写法，换其它平台照此自己写）。当用户要移植常用驱动——DHT11、DS18B20、HC-05、HC-SR04、MPU6050、SSD1306、SG90 舵机、28BYJ-48 步进、ESP8266-AT——或问这个驱动占哪些外设、初始化顺序有什么硬要求、接线怎么接有什么坑、换一块芯片怎么改时使用。9 款驱动全部带验证记录+接线表+坑清单，外设用法取自各驱动适配层注释原句。模板是移植参考非即拷即用；不生成新驱动代码（用 embedded-code-generator）、不做协议一致性判定与报文拆解（随嵌入式联调专家包提供）。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher liujycode · publishing for 22 daysInstalls 17Last detonated 23 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Python subprocess execution detectedtests/run_c_tests.py:70 · Python subprocess execution detectedreturn subprocess.run(cmd, capture_output=True, text=True, env=env, cwd=cwd)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/run_c_tests.py:120 · Python subprocess execution detectedrr = subprocess.run([exe], capture_output=True, text=True, env=env, cwd=TESTS)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈1,118 tok
1 file · 63 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim liujycode: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim liujycodePropose a patch to the maintainer