Agent skill · Audited from source

can

skill · zhinkgit/embeddedskillsMIT licenceAudited 21 Oct 2026 · source 674ae8bca880

★ 756pushed 1 day ago
!CAUTIONGrade B · 89/100 · 5 findings · 674ae8b
756repo stars · whole zhinkgit/embeddedskills

Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit 674ae8bca880 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 5 findings, 0 critical or high. What it does: 嵌入式 CAN / CAN-FD 调试工具,用于扫描接口、监控报文、发送测试帧、记录日志、数据库文件解码和总线统计。 当用户提到 CAN、CAN-FD、DBC 解码、总线抓包、USB-CAN 联调、报文发送、总线统计、 PCAN、Vector、slcan、CAN 接口扫描、CAN ID 过滤、ASC 日志、BLF 文件时自动触发, 也兼容 /can 显式调用。即使用户只是说"看看 CAN 报文"、"发一帧试试"或"解码一下 DBC",…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “can (zhinkgit/embeddedskills)”. Retrieved 21 Oct 2026. https://modelsatlas.com/skills/zhinkgit/can

Trust audit

Audit 0.4.1 · source read 21 Oct 2026

Trust score89/100!CAUTION B
0 critical0 high1 medium4 low0 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS4
L2 InstructionsPrompt injection, authority framing, hidden directivesWARN1
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (5)

MEDIUMPrivilege escalation / persistencereview.unsafe_action · SKILL.md
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L2
`send` 只要配置可连接就直接执行,不二次确认
Why
The high-risk send command runs directly without user confirmation when a connection is available, sending frames to the bus at the agent's discretion.
Fix
rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWObfuscation / stealthobf.decode_call · scripts/can_decode.py:11
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return bytes.fromhex(s)
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · scripts/can_send.py:21
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return bytes.fromhex(s)
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · scripts/can_stats.py:161
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"last_data": format_data(bytes.fromhex(id_last_data.get(arb_id, ""))),
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · scripts/can_stats.py:175
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"last_data": format_data(bytes.fromhex(id_last_data.get(arb_id, ""))),
Why
No further detail recorded for this rule.
Fix
—

Audit 0.4.1 · source sha 674ae8bca880 · 21 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherzhinkgit GitHub userOwner of the repository this skill is read from
  • Source folderzhinkgit/embeddedskills/canThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict674ae8bca880A new audit runs when the source changes
  • Repository statusNot archivedLast push 1 day ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: 嵌入式 CAN / CAN-FD 调试工具,用于扫描接口、监控报文、发送测试帧、记录日志、数据库文件解码和总线统计。 当用户提到 CAN、CAN-FD、DBC 解码、总线抓包、USB-CAN 联调、报文发送、总线统计、 PCAN、Vector、slcan、CAN 接口扫描、CAN ID 过滤、ASC 日志、BLF 文件时自动触发, 也兼容 /can 显式调用。即使用户只是说"看看 CAN 报文"、"发一帧试试"或"解码一下 DBC",…

---
name: can
description: >-
  嵌入式 CAN / CAN-FD 调试工具,用于扫描接口、监控报文、发送测试帧、记录日志、数据库文件解码和总线统计。
  当用户提到 CAN、CAN-FD、DBC 解码、总线抓包、USB-CAN 联调、报文发送、总线统计、
  PCAN、Vector、slcan、CAN 接口扫描、CAN ID 过滤、ASC 日志、BLF 文件时自动触发,
  也兼容 /can 显式调用。即使用户只是说"看看 CAN 报文"、"发一帧试试"或"解码一下 DBC",
  只要上下文明确提到 CAN 总线通信的操作或问题就应触发此 skill。
argument-hint: "[scan|monitor|send|log|decode|stats] ..."
---

# CAN — 嵌入式 CAN / CAN-FD 调试工具

统一封装接口发现、实时监控、报文发送、日志记录、数据库文件解码和统计分析能力。

## 配置

### 环境级配置 (`skill/config.json`)

仅保留 slcan 相关的环境级配置:

```json
{
  "slcan_serial_port": "",
  "slcan_serial_baudrate": 115200
}
```

| 字段 | 说明 | 默认值 |
|------|------|--------|
| `slcan_serial_port` | slcan 场景的串口 | `""` |
| `slcan_serial_baudrate` | slcan 场景的串口速率 | `115200` |

### 工程级配置 (`.embeddedskills/config.json`)

工作区下的 `.embeddedskills/config.json` 存放工程级 CAN 配置:

```json
{
  "can": {
    "interface": "",
    "channel": "",
    "bitrate": 500000,
    "data_bitrate": 2000000,
    "log_dir": ".embeddedskills/logs/can"
  }
}
```

| 字段 | 说明 | 默认值 |
|------|------|--------|
| `interface` | CAN 后端,如 `pcan` / `vector` / `slcan` | `""` |
| `channel` | 通道名,如 `PCAN_USBBUS1` | `""` |
| `bitrate` | 仲裁域比特率 | `500000` |
| `data_bitrate` | CAN-FD 数据域比特率 | `2000000` |
| `log_dir` | 日志输出目录 | `.embeddedskills/logs/can` |

### 参数解析优先级

1. **CLI 参数** (`--interface`, `--channel`, `--bitrate` 等) - 最高优先级
2. **工程级配置** (`.embeddedskills/config.json` 中的 `can` 部分)
3. **状态文件** (`.embeddedskills/state.json` 中的历史记录)
4. **默认值** - 最低优先级

### 自动扫描行为

`scan` 的 `details.interfaces` 及摘要数量只包含检测到的 USB-CAN 设备和 SocketCAN 接口。`details.registered_backends` 单独列出已注册的软件后端,不代表驱动可用或硬件已连接,也不参与自动选择。

当未指定 `interface` 和 `channel` 时,脚本会自动扫描系统 CAN 接口,按以下步骤处理:

1. 扫描系统中所有可用 CAN 接口
2. 若只找到一个接口 → 自动使用并写入工程配置
3. 若找到多个接口 → 返回候选列表,等待用户选择
4. 若未找到接口 → 提示错误,停止执行

## 子命令

| 子命令 | 用途 | 风险 |
|--------|------|------|
| `scan` | 扫描可用 CAN 接口与 USB-CAN 设备 | 低 |
| `monitor` | 实时监控总线报文 | 低 |
| `send` | 发送标准帧 / 扩展帧 / 远程帧 / CAN-FD 帧 | 高 |
| `log` | 记录总线报文到 ASC / BLF / CSV 文件 | 低 |
| `decode` | 用 DBC 等数据库文件解码报文或日志 | 低 |
| `stats` | 统计总线负载、ID 分布和帧率 | 低 |

## 执行流程

1. 检查 `python-can` 是否可用,未安装时提示 `pip install python-can`
2. 按优先级解析参数:CLI > 工程级配置 > 状态文件 > 默认值
3. 无子命令时默认执行 `scan`
4. `monitor / send / log / stats` 使用解析后的连接参数
5. `decode` 先确认数据库文件和输入源存在
6. 若未指定 `interface`/`channel`,自动扫描系统 CAN 接口:
   - 唯一候选:自动使用并写入工程配置
   - 多候选:返回列表让用户选择
7. 成功执行后,将确认的参数写回工程配置
8. `send` 只要配置可连接就直接执行,不二次确认
9. 运行对应脚本并输出结构化结果
10. 失败时优先反馈接口、驱动、比特率和过滤条件问题

## 脚本调用

所有脚本位于 skill 目录的 `scripts/` 下,通过 `python` 直接调用。
脚本会按优先级从 CLI 参数、工程级配置、状态文件中读取参数。

```bash
# 扫描接口
python scripts/can_scan.py [--json]

# 实时监控
python scripts/can_monitor.py [--interface <接口>] [--channel <通道>] [--bitrate <速率>] [--fd] [--filter-id <ID列表>] [--exclude-id <ID列表>] [--dbc <DBC文件>] [--timeout <秒>] [--json]

# 发送报文
python scripts/can_send.py [--interface <接口>] [--channel <通道>] [--bitrate <速率>] <id> <data> [--extended] [--remote] [--fd] [--repeat <次>] [--interval <秒>] [--periodic <毫秒>] [--listen] [--json]

# 日志记录
python scripts/can_log.py [--interface <接口>] [--channel <通道>] [--bitrate <速率>] [--output <文件>] [--duration <秒>] [--max-count <数量>] [--filter-id <ID列表>] [--console] [--json]

# 数据库解码
python scripts/can_decode.py <db_file> [--db-format <auto|dbc|arxml|kcd|sym|cdd>] [--id <CAN_ID>] [--data <HEX数据>] [--log <日志文件>] [--signal <信号名>] [--list] [--json]

# 总线统计
python scripts/can_stats.py [--interface <接口>] [--channel <通道>] [--bitrate <速率>] [--duration <秒>] [--top <数量>] [--watch <ID列表>] [--json]
```

## 输出格式

单次命令返回标准 JSON:
```json
{
  "status": "ok",
  "action": "scan",
  "summary": "发现 2 个 CAN 接口",
  "details": { ... }
}
```

持续命令(monitor --json、send --listen --json)输出 JSON Lines,结束摘要写入 stderr。

错误输出:
```json
{
  "status": "error",
  "action": "send",
  "error": { "code": "interface_open_failed", "message": "无法打开指定 CAN 接口" }
}
```

## 核心规则

- 不自动猜测 interface、channel、bitrate,多接口时不自动选择
- 参数解析优先级:CLI > 工程级配置 > 状态文件 > 默认值;自动扫描结果仅在未提供 CLI 参数时生效
- 未指定 `interface`/`channel` 时自动扫描,唯一候选自动写入配置,多候选需用户选择
- 成功执行后,确认的参数自动写回 `.embeddedskills/config.json`
- 未明确说明用途时不主动发送任何报文
- `--json` 输出的持续流使用 JSON Lines,摘要写 stderr 不污染数据流
- DBC 解码失败不应导致监控中断
- 找不到帧定义时返回明确错误,不静默吞掉

## 参考

- `references/common_interfaces.json`:常见 USB-CAN 设备信息

Excerpt, first 4,181 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 674ae8b

Download folder ↗
git clone https://github.com/zhinkgit/embeddedskills
git -C embeddedskills checkout 674ae8bca880

The author documents no install command, so this uses the repository directly. Our verdict covers commit 674ae8bca880 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION B 89 / 100

    first audit · source 674ae8bca880

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/zhinkgit/can/badge.svg)](https://modelsatlas.com/skills/zhinkgit/can/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

workflow✓SAFE

zhinkgit/embeddedskills

embeddedskills 的薄编排层,用于在当前 workspace 中发现工程、选择 build/flash/debug/observe 后端、串联 .embeddedskills/state.json,并聚合底层 skill 的结果。 当用户明确输入以下命令之一:"一键构建烧录"、"自动诊断"、"串起 build -> flash -> debug -> observe" 或显式调用 /workflow 时触发。

★ 772Grade B
serial✓SAFE

zhinkgit/embeddedskills

嵌入式串口调试工具,用于扫描串口、实时监控、发送数据、记录日志和 Hex 查看。 当用户提到串口、COM 口、UART、AT 命令调试、波特率、Hex 串流、串口抓日志、 串口监控、查看 MCU 输出、二进制协议联调时自动触发,也兼容 /serial 显式调用。 即使用户只是说"看看串口输出"、"发个 AT 命令"或"抓一下日志",只要上下文涉及 串口通信就应触发此 skill。

★ 769Grade B
ssh✓SAFE

zhinkgit/embeddedskills

SSH/服务器操作助手。用于远程服务器、user@host、SSH 配置、上传下载、部署、跳板机、隧道、端口转发、服务器命令执行等任务;以 ~/.ssh/config 的 Host 别名为唯一服务器清单,优先密钥认证,通过本 skill 的 Python 脚本封装 OpenSSH 操作。

★ 769Grade B
terminal✓SAFE

zhinkgit/embeddedskills

双向交互终端会话工具,用于串口终端、SSH 交互 Shell、本地 Shell、设备控制台、AT/CLI 菜单、需要保持上下文的交互式调试;当用户提到交互终端、串口终端、SSH 终端、打开 shell、发送命令后继续读输出、保持会话、登录后操作、菜单式命令行时触发,也兼容 /terminal 显式调用。

★ 769Grade B
probe-rs✓SAFE

zhinkgit/embeddedskills

probe-rs 下载与调试工具,用于探针发现、固件烧录、复位、内存读写、GDB Server 调试和 RTT 日志读取。 当用户提到 probe-rs、cargo-embed、DAP、RTT、CMSIS-DAP、ST-Link、J-Link、烧录、芯片信息、 连接 under reset、probe 选择器、probe-rs gdb、probe-rs attach 时自动触发,也兼容 /probe-rs 显式调用。…

★ 767Grade B
openocd✓SAFE

zhinkgit/embeddedskills

OpenOCD 下载与调试工具,用于探针探测、固件烧录、Flash 擦除、GDB Server 启动、目标复位控制、 Telnet 在线调试(halt/resume/step/寄存器/内存/断点)、GDB 源码级调试,以及 Semihosting/ITM 输出捕获和底层查询。 当用户提到 OpenOCD、ST-Link、CMSIS-DAP、DAPLink、FTDI、烧录固件、擦除 Flash、GDB Server、…

★ 766Grade B

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/zhinkgit/can/badge.svg)](https://modelsatlas.com/skills/zhinkgit/can/)

Questions about can

What does the can skill do?
An open-source collection of embedded development and debugging skills for Claude Code, Copilot, TRAE, and other AI coding assistants that support the Skill protocol. Once installed, the AI assistant can directly operate compilers, debuggers, and communication buses, automating the full workflow fro
Is can safe to install?
With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can can access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does can work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (674ae8bca880), read on 2026-10-21. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.