Toon
PassAudited by ClawScan on May 1, 2026.
Overview
This is a benign instruction-only JSON compression skill, but its setup references a missing helper script and Node/npx CLI dependency that users should verify before installing.
This skill appears safe for compressing JSON output, but verify the `toon` executable or npm CLI before installing it. If you need exact raw JSON rather than a compressed representation, tell the agent not to pipe that output through `toon`.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may show compressed TOON instead of raw JSON, which could matter if you need exact JSON syntax or byte-for-byte output.
The skill broadly encourages routing command output through the formatter. This is aligned with its stated compression purpose, but it changes how JSON is represented in context.
- **Always** when fetching JSON APIs - **Always** when reading JSON files into context - Safe to use on any output — non-JSON passes through
Use the skill for context savings, but ask for raw JSON when exact formatting, ordering, escaping, or machine-valid JSON output is required.
Installing or running an unreviewed helper script or npm CLI could execute code outside the reviewed skill artifacts.
The instructions reference a local helper script and an npm-based CLI, but the reviewed skill contains only SKILL.md and no install spec or script file. This is a provenance/setup gap rather than evidence of malicious behavior.
cp scripts/toon ~/.local/bin/ chmod +x ~/.local/bin/toon Requires: `npx` (Node.js) CLI: `@toon-format/cli`
Verify the source of the `toon` script or install the official `@toon-format/cli` from a trusted source before adding it to PATH.