hunch-board@1.0.0
VERIFIED· install onlyPublisher claims: "Hunch Board (hunchboard.dev): one free board for planning a project, kept as a text file. Boxes, UML, decisions, screens, checklists, images and any file." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher chyper00 · publishing for 9 daysInstalls 292Last detonated 3 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packageSKILL.md:461 · npx invocation of non-well-known package — may execute untrusted code
AST06npx hunch-board check --json # does every line read, and is every file on the board in the folder: { ok, issues }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagehunch.mjs:27 · npx invocation of non-well-known package — may execute untrusted code
AST06…ad \`.claude/skills/hunch/SKILL.md\` before you change a board. Check it with \`npx hunch-board check --json\`, or \`node .hunch/hunch.mjs check --json\` when that file is in …Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:457 · npx invocation of non-well-known package — may execute untrusted code
AST06One file, Node 20 or newer. `npx hunch-board` is the same file from npm.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:460 · npx invocation of non-well-known package — may execute untrusted code
AST06npx hunch-board init # board.hunch, this skill, and a note in AGENTS.md and CLAUDE.mdFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:462 · npx invocation of non-well-known package — may execute untrusted code
AST06npx hunch-board render # the board as SVG, transparent background, so a chat can show it. Pass boards/api.hunch for that boardFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageSKILL.md:463 · npx invocation of non-well-known package — may execute untrusted code
AST06npx hunch-board search telegram # boards other people shared, to learn from or start fromFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagehunch.mjs:26 · npx invocation of non-well-known package — may execute untrusted code
AST06…`\n\n## From the terminal, and as an MCP server\n\nOne file, Node 20 or newer. `npx hunch-board` is the same file from npm.\n\n```\nnpx hunch-board init # board.hun…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagehunch.mjs:34 · npx invocation of non-well-known package — may execute untrusted code
AST06- Check the drawing: \`npx hunch-board check --json\`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)hunch.mjs:26 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04… inputs and outputs (PII, safety, format) and running evals. |\n| MCP server | `mcp-server` | Exposing your system\'s tools and data to AI assistants via Model Context Protocol. |\n\n**Security & identity**\n\n| Type | Id | Use for |\n|---…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File type combined with upload actionhunch.mjs:26 · File type combined with upload action — agent may exfiltrate local data files
AST07…ok:!1,text:`Not a board on Hunch: ${h}`};let n=await fetch(`${U5()}/b/${r}/files.json`);if(!n.ok)return{ok:!1,text:`No public board called ${r}.`};let{title:o,files:m}=await n.json(),b=K5(a,i??r);if(!b.startsWith(K5(a)))return{ok:!1,text:`…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)hunch.mjs:4 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…vals","ai","octagon","guardrails moderation evals safety filter","Guardrails"),"mcp-server":c("MCP server","ai","box","mcp model context protocol tools claude","MCP server"),"auth-provider":c("Identity provider","security","octagon","auth0…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.Cost to the agent
Instructions loaded
≈7,058 tok
1 file · 9 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for hunch-board@1.0.0 as of 2 h ago. This is the package itself, not its dependencies.