canva-design-workspace-toolkit

SUSPICIOUS. The skill’s main body is benign Canva workflow documentation, but it embeds an unrelated remote PowerShell installer from a different GitHub owner. That download-execute chain is not necessary for the stated purpose and is currently unverifiable, creating a high supply-chain risk despite no confirmed payload or credential theft.