Canva Connect

This skill appears to be a real Canva Connect integration, but there are several things you should check before installing or providing credentials: - Verify the owner/source. The 'Source' and 'Homepage' are missing in the registry; prefer skills from a known publisher. - Inspect the included script (scripts/canva.sh) yourself. It will run a local OAuth flow, start a small Python HTTP server to capture the auth code, and write tokens to ~/.clawdbot/canva-tokens.json. Ensure you trust the code before running it. - Confirm required tools are available (curl, jq, openssl, python3). The registry metadata omits these requirements but the script needs them. - Scope/privilege mismatch: the script requests write-capable OAuth scopes (design:content:write, asset:write, folder:write) even though the README claims the skill "cannot add content to designs". If you only need exports/reads, consider creating an OAuth client with minimal (read-only) scopes or do not grant write scopes/secret to this skill. - Prefer setting CANVA_CLIENT_ID and CANVA_CLIENT_SECRET as environment variables in a controlled environment rather than pasting secrets into shared config files. Rotate credentials if you suspect misuse. - If uncertain, run the CLI in an isolated environment (container or VM) to limit blast radius. If you want, I can highlight the exact lines in scripts/canva.sh that request scopes and write tokens so you can more easily review them.