dreamina-canvas-create

SUSPICIOUS: the skill’s behavior is largely coherent and narrowly scoped for canvas/project-id management, with no clear credential harvesting or exfiltration. The main issue is trust: it depends on an external CLI, dreamina-canvas, whose official provenance was not verified from the provided evidence, so the required binary is effectively an unverifiable dependency and drives the risk upward.