squinch@0.19.0
VERIFIED· install onlyPublisher claims: "Architecture diagrams as code for coding agents: install the skill, then check, render, diff and watch .squinch projects — clean, zoomable diagrams with real cloud icons, as deterministic SVG, PNG or interactive HTML." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
throw new Error(`unknown --format \`${format}\` — use text | json | markdown`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.command: npxFix: Pin versions and sources; vendor anything fetched at install time.const npx = (deps.argv1 ?? "").includes("_npx");Fix: Pin versions and sources; vendor anything fetched at install time.throw new Error(`unknown --format \`${format}\` — use svg | png | html`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.--claude also write .claude/skills/ even if no CLAUDE.md is foundFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.…ers \"order_id\"\n }\n svc -> db.orders \"writes\"\n}\nview db { scope shop.db } // standing in the database: every field\n```\n\nColumns — only when the request asks what is *in* a store. Any leaf takes a\n`fields { }` block (a table, a c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.… cookbook.\ncompatibility: Requires Node.js 22+ and the squinch CLI on PATH, or npx squinch with no install\n---\n\n# Squinch — architecture diagrams as code\n\nSquinch re…Fix: Pin versions and sources; vendor anything fetched at install time.? `npx ${pkg.name}@latest skill`Fix: Pin versions and sources; vendor anything fetched at install time.console.error(`\nthe skill drives \`squinch check\` and \`squinch render\`, so keep squinch on\nPATH (\`npx squinch\` works too) — and re-run this after upgrading to refresh`);Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for squinch@0.19.0 as of 2d ago. This is the package itself, not its dependencies.