Security audit
Security checks across malware telemetry and agentic risk
This is a coherent Canva integration that uses expected OAuth tokens and Canva API calls, with sensitive permissions users should handle carefully.
Install only if you are comfortable giving this skill read/write access to the connected Canva account. Use the minimum Canva scopes you need, protect CANVA_CLIENT_SECRET and ~/.canva/tokens.json, keep token file permissions restrictive, and confirm exact file paths before using upload commands because selected files are sent to Canva.
if echo "$RESPONSE" | jq -e '.access_token' > /dev/null 2>&1; then
echo "$RESPONSE" > "$TOKEN_FILE"
echo "✅ Token refreshed successfully!"
echo "Access token saved to: $TOKEN_FILE"
exit 0
else
echo "⚠️ Refresh failed, need to re-authenticate"65/65 vendors flagged this skill as clean.
No suspicious patterns detected.