collab-canvas

SUSPICIOUS. The skill's stated purpose mostly matches its capabilities, but it depends on a locally installed external CLI with only partially verifiable provenance and broad PTY control. The main concerns are supply-chain trust in the required binary and the ability to drive arbitrary commands through terminal tiles, not confirmed malware or credential theft.