📦 Unihiker K10 MicroPython — 掌控板开发
v1.0.0一键在 Unihiker K10 开发板上使用 MicroPython：上传脚本、刷固件、调用屏幕、传感器、RGB、音频与 AI 等全套 API，快速完成物联网原型。
0· 120·0 当前·0 累计
by 下载技能包
最后更新
2026/3/23
安全扫描
OpenClaw
可疑
medium confidenceNULL
评估建议
This skill appears to do what it claims, but take precautions before running its setup or flash scripts: 1) The setup script runs curl | sh against raw.githubusercontent.com and performs pip installs and may move binaries with sudo — review that installer script and the pip packages before executing. 2) The flashing scripts expect a firmware binary at ${HOME}/.claude/skills/unihiker-k10/firmware/k10-micropython-v0.9.2.bin, but that file is not in the package; verify the firmware source and integ...详细分析 ▾
ℹ 用途与能力
Name/description match the provided scripts and documentation: find-port, flash, upload, and API reference are all present and appropriate for programming a K10 with MicroPython. However, the flashing scripts reference a firmware binary at ${HOME}/.claude/skills/unihiker-k10/firmware/k10-micropython-v0.9.2.bin which is not included in the manifest — this mismatch should be explained (where does the firmware come from?).
⚠ 指令范围
SKILL.md and the scripts instruct the agent/user to run local shell scripts that access serial devices (/dev/*, COM ports), read/write files under HOME, and perform firmware flashing. Those actions are expected for the stated purpose. The concern is that setup.sh will execute network installs (curl | sh) and pip installs at runtime and potentially move binaries into system locations; these steps expand the scope beyond purely device-local operations and execute code fetched from the network.
⚠ 安装机制
There is no formal install spec; instead the bundled setup.sh performs dynamic installs: it curls and pipes the arduino-cli installer from raw.githubusercontent.com (remote script execution), runs pip installs for mpremote/ampy, and may move binaries to /usr/local/bin (sudo). Downloading and executing an installer script (curl | sh) and performing pip installs at runtime are moderate-to-high risk behaviors and should be reviewed before running. The firmware binary the flash scripts expect is not present in the package, implying an external download step is required but not specified.
✓ 凭证需求
The skill requests no environment variables or credentials and does not try to access unrelated secret locations. It does reference HOME and places files under ~/.k10 and (implicitly) ~/.claude, which is plausible for per-user configuration. No tokens/keys are requested.
ℹ 持久化与权限
always is false and the skill is not force-enabled. setup.sh will create a ~/.k10 directory and may install system tools and libraries, potentially requiring sudo to move binaries into /usr/local/bin and modifying system state. That is reasonable for a developer tool but elevates the impact of running the script—review and run with least privilege (or in a container) if possible.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/23
NULL
● 可疑
安装命令
点击复制官方npx clawhub@latest install unihiker-k10-micropython
镜像加速npx clawhub@latest install unihiker-k10-micropython --registry https://cn.longxiaskill.com