v1.0.0

Toon

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 4:57 AM.

Analysis

This is a benign instruction-only JSON compression skill, but its setup references a missing helper script and Node/npx CLI dependency that users should verify before installing.

GuidanceThis skill appears safe for compressing JSON output, but verify the `toon` executable or npm CLI before installing it. If you need exact raw JSON rather than a compressed representation, tell the agent not to pipe that output through `toon`.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityInfoConfidenceHighStatusNote

SKILL.md

- **Always** when fetching JSON APIs
- **Always** when reading JSON files into context
- Safe to use on any output — non-JSON passes through

The skill broadly encourages routing command output through the formatter. This is aligned with its stated compression purpose, but it changes how JSON is represented in context.

User impactThe agent may show compressed TOON instead of raw JSON, which could matter if you need exact JSON syntax or byte-for-byte output.

RecommendationUse the skill for context savings, but ask for raw JSON when exact formatting, ordering, escaping, or machine-valid JSON output is required.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

cp scripts/toon ~/.local/bin/
chmod +x ~/.local/bin/toon

Requires: `npx` (Node.js)

CLI: `@toon-format/cli`

The instructions reference a local helper script and an npm-based CLI, but the reviewed skill contains only SKILL.md and no install spec or script file. This is a provenance/setup gap rather than evidence of malicious behavior.

User impactInstalling or running an unreviewed helper script or npm CLI could execute code outside the reviewed skill artifacts.

RecommendationVerify the source of the `toon` script or install the official `@toon-format/cli` from a trusted source before adding it to PATH.