dreamina-canvas-compose

SUSPICIOUS: the skill’s behavior is largely coherent and well-scoped for non-charging Canvas composition, but it depends on an external Dreamina CLI with weak install-trust evidence (official-looking yet unpinned curl|bash, limited verification, no clear signed/checksummed release path). I found no direct credential theft, exfiltration, or hidden execution in the skill content itself.