canva-prod-checklist
Facilitates the deployment of Canva integrations by executing a comprehensive production checklist for readiness and security.
Install this skill
Security score
The canva-prod-checklist skill was audited on May 23, 2026 and we found 18 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 126 | headers: { 'Authorization': `Bearer ${getServiceToken()}` }, |
Template literal with variable interpolation in command context
| 129 | canvaStatus = me.ok ? 'healthy' : `error:${me.status}`; |
Curl to non-GitHub URL
| 85 | DESIGN=$(curl -s -X POST "https://api.canva.com/rest/v1/designs" \ |
Curl to non-GitHub URL
| 94 | EXPORT=$(curl -s -X POST "https://api.canva.com/rest/v1/exports" \ |
Fetch to external URL
| 125 | const me = await fetch('https://api.canva.com/rest/v1/users/me', { |
Webhook reference - potential data exfiltration
| 54 | ### Webhook Security |
Webhook reference - potential data exfiltration
| 56 | - [ ] Webhook endpoint uses HTTPS |
Webhook reference - potential data exfiltration
| 57 | - [ ] JWK signature verification implemented (see `canva-webhooks-events`) |
Webhook reference - potential data exfiltration
| 58 | - [ ] Webhook handler returns 200 immediately |
Webhook reference - potential data exfiltration
| 112 | 3. Preview features (e.g., webhooks) are **not allowed** in public integrations |
Webhook reference - potential data exfiltration
| 158 | | Webhook URL rejected | HTTP not HTTPS | Use HTTPS endpoint | |
External URL reference
| 81 | "https://api.canva.com/rest/v1/users/me") |
External URL reference
| 85 | DESIGN=$(curl -s -X POST "https://api.canva.com/rest/v1/designs" \ |
External URL reference
| 94 | EXPORT=$(curl -s -X POST "https://api.canva.com/rest/v1/exports" \ |
External URL reference
| 125 | const me = await fetch('https://api.canva.com/rest/v1/users/me', { |
External URL reference
| 163 | - [Canva Connect Quickstart](https://www.canva.dev/docs/connect/quickstart/) |
External URL reference
| 164 | - [Creating Integrations](https://www.canva.dev/docs/connect/creating-integrations/) |
External URL reference
| 165 | - [Canva Changelog](https://www.canva.dev/docs/connect/changelog/) |