json-canvas

The SKILL.md carries a transparency concern due to an obfuscated or encoded execution path, which weakens pre-use reviewability and makes it harder to fully assess what the skill does before loading it. Prompt injection boundaries stay reasonably clear—the skill does not push the agent to treat external data as instructions. However, because behavior analysis was not run and the obfuscation issue remains unresolved, confidence is low; the scan flagged enough to warrant a WARNING, but finite testing cannot rule out latent risks hidden behind the unclear execution path.