Canva

• Analyzed: May 12, 2026, 3:09 AM
• Findings: 1
• Version: 1.0.0
• Hash: dbeac7a2d218faf7763555ae06c542c7c203adec1efe6f340b82752467dbf8f6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Canva appears benign. It provides a legitimate integration with the Canva API, handling OAuth authentication and API calls. Sensitive data like `CANVA_CLIENT_ID`, `CANVA_CLIENT_SECRET`, and access tokens are handled via environment variables and a local file (`~/.canva/tokens.json`) with secure permissions (`chmod 600`). All network requests are directed to the official Canva API endpoint (`https://api.canva.com/rest/v1`). There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` or `README.md` designed to subvert the agent's behavior beyond its stated purpose.