Is json-canvas safe to install?

SaferSkills independently audited json-canvas (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/json-canvas/SKILL.md · 1 file

skills/json-canvas/SKILL.md4.8 KB · Markdown

name: json-canvas

description: Create and edit JSON Canvas files (.canvas) with nodes, edges, groups, and connections. Use when working with .canvas files, creating visual canvases, mind maps, flowcharts, or when the user mentions Canvas files in Obsidian.

JSON Canvas Skill

File Structure

A canvas file (.canvas) contains two top-level arrays following the JSON Canvas Spec 1.0:

{
  "nodes": [],
  "edges": []
}

Common Workflows

1. Create a New Canvas

Create a .canvas file with the base structure {"nodes": [], "edges": []}
Generate unique 16-character hex IDs for each node (e.g., "6f0ad84f44ce9c17")
Add nodes with required fields: id, type, x, y, width, height
Add edges referencing valid node IDs via fromNode and toNode
Validate: Verify all fromNode/toNode values exist in the nodes array

2. Add a Node to an Existing Canvas

Read and parse the existing .canvas file
Generate a unique ID that does not collide with existing IDs
Choose position (x, y) that avoids overlapping existing nodes (50-100px spacing)
Append the new node object to the nodes array
Validate: Confirm all IDs are unique and all edge references resolve

3. Connect Two Nodes

Identify the source and target node IDs
Generate a unique edge ID
Set fromNode and toNode to the source and target IDs
Optionally set fromSide/toSide (top, right, bottom, left) and label
Validate: Confirm both IDs reference existing nodes

Nodes

Nodes are objects placed on the canvas. Array order determines z-index (first = bottom layer).

Generic Node Attributes

Attribute	Required	Type	Description
`id`	Yes	string	Unique 16-char hex identifier
`type`	Yes	string	`text`, `file`, `link`, or `group`
`x`	Yes	integer	X position in pixels
`y`	Yes	integer	Y position in pixels
`width`	Yes	integer	Width in pixels
`height`	Yes	integer	Height in pixels
`color`	No	string	Preset `"1"`-`"6"` or hex (e.g., `"#FF0000"`)

Text Node

{
  "id": "6f0ad84f44ce9c17",
  "type": "text",
  "x": 0, "y": 0, "width": 400, "height": 200,
  "text": "# Hello World\n\nThis is **Markdown** content."
}

Newline pitfall: Use \n in JSON strings. Do not use literal \\n.

File Node

{
  "id": "a1b2c3d4e5f67890",
  "type": "file",
  "x": 500, "y": 0, "width": 400, "height": 300,
  "file": "Attachments/diagram.png"
}

Link Node

{
  "id": "c3d4e5f678901234",
  "type": "link",
  "x": 1000, "y": 0, "width": 400, "height": 200,
  "url": "https://obsidian.md"
}

Group Node

{
  "id": "d4e5f6789012345a",
  "type": "group",
  "x": -50, "y": -50, "width": 1000, "height": 600,
  "label": "Project Overview",
  "color": "4"
}

Edges

Attribute	Required	Default	Description
`id`	Yes	-	Unique identifier
`fromNode`	Yes	-	Source node ID
`toNode`	Yes	-	Target node ID
`fromSide`	No	-	`top`, `right`, `bottom`, or `left`
`toSide`	No	-	`top`, `right`, `bottom`, or `left`
`fromEnd`	No	`none`	`none` or `arrow`
`toEnd`	No	`arrow`	`none` or `arrow`
`color`	No	-	Line color
`label`	No	-	Text label

{
  "id": "0123456789abcdef",
  "fromNode": "6f0ad84f44ce9c17",
  "fromSide": "right",
  "toNode": "a1b2c3d4e5f67890",
  "toSide": "left",
  "label": "leads to"
}

Colors

Preset	Color
`"1"`	Red
`"2"`	Orange
`"3"`	Yellow
`"4"`	Green
`"5"`	Cyan
`"6"`	Purple

Layout Guidelines

Coordinates can be negative (canvas extends infinitely)
x increases right, y increases down; position is the top-left corner
Space nodes 50-100px apart; leave 20-50px padding inside groups
Align to grid (multiples of 10 or 20) for cleaner layouts

Node Type	Suggested Width	Suggested Height
Small text	200-300	80-150
Medium text	300-450	150-300
Large text	400-600	300-500

Validation Checklist

After creating or editing a canvas file:

All id values are unique across both nodes and edges
Every fromNode and toNode references an existing node ID
Required fields are present for each node type
type is one of: text, file, link, group
Side values are one of: top, right, bottom, left
End values are one of: none, arrow
JSON is valid and parseable

json-canvas— agent skill

Is json-canvas safe to install?

JSON Canvas Skill

File Structure

Common Workflows

1. Create a New Canvas

2. Add a Node to an Existing Canvas

3. Connect Two Nodes

Nodes

Generic Node Attributes

Text Node

File Node

Link Node

Group Node

Edges

Colors

Layout Guidelines

Validation Checklist

References

Audit the pieces. Scan the whole. Decide.