dreamina-canvas-auth

SUSPICIOUS. The skill’s stated purpose and actions are internally coherent for authentication management, and the flagged `.config` access is documentation context rather than active credential theft. However, the skill depends on a preinstalled `dreamina-canvas` authentication CLI whose exact official provenance could not be verified from the supplied evidence; because that binary necessarily handles credentials, this creates a high trust and credential-forwarding risk even without explicit exfiltration in the skill itself.