HiLink LTE Modem
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill appears purpose-built for controlling a local Huawei HiLink modem, but it can send/delete SMS, handle SIM PINs, and run privileged network commands.
Install only if you want the agent to control a local Huawei HiLink modem. Treat SMS content, message deletion, SIM PIN entry/disablement, and sudo network setup as sensitive actions, and review commands before allowing them.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could send chargeable or sensitive SMS messages, remove messages, or weaken SIM security if the user asks for or permits those actions.
The skill exposes write operations that can send messages, delete modem SMS data, and change SIM PIN protection. These actions fit the stated purpose but are high-impact if invoked accidentally.
scripts/hilink.sh sms send "+41791234567" "Hello!" scripts/hilink.sh sms delete 40001 scripts/hilink.sh pin disable 1234
Use the skill only with explicit phone numbers, message text, SMS IDs, and PIN actions; confirm before sending, deleting, or disabling SIM PIN protection.
Anyone or any agent run with access to the configured PIN can unlock or manage the SIM through the modem.
The script can use a SIM PIN from the environment/config and submit it to the modem API. This is expected for SIM management but is credential-like access.
SIM_PIN="${HILINK_PIN:-}" # Set in config or pass via 'pin enter'
...<CurrentPin>${SIM_PIN}</CurrentPin>...Store any HILINK_PIN value carefully, restrict permissions on the config file, and prefer entering the PIN only when needed if the environment is shared.
If the wrong interface or settings are used, local networking could be temporarily disrupted.
The helper script can run privileged networking commands to bring up the LTE interface and remove a default route. This is purpose-aligned but changes local system networking.
sudo ip addr add "$STATIC_IP" dev "$iface" 2>/dev/null || true sudo ip link set "$iface" up 2>/dev/null ... sudo ip route del default via "$GATEWAY" dev "$iface" 2>/dev/null || true
Verify the modem interface name, gateway, and static IP before running initialization commands, especially on systems with multiple USB network adapters.
A user may not realize from the registry metadata that the skill uses local shell tooling, sudo networking commands, and a config file.
The registry metadata does not declare the local tools, config file, or environment variables that the script and documentation use. This is not malicious, but it makes the required runtime authority less visible from metadata alone.
Required binaries (all must exist): none Env var declarations: none Required config paths: none
Review SKILL.md and scripts/hilink.sh before use, and ensure required local tools and config values are expected on the target machine.