Canva
v1.0.0Canva integration. Manage data, records, and automate workflows. Use when the user wants to interact with Canva data.
⭐ 0· 64·0 current·0 all-time
byVlad Ursul@gora050
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (Canva integration) matches the instructions: the SKILL.md consistently instructs using the Membrane CLI to list/connect to Canva connectors, run actions, and proxy requests. Required capabilities (network + Membrane account) are appropriate for the stated purpose.
Instruction Scope
The instructions stay within the Canva-integration scope: they tell the agent/operator to install and use @membranehq/cli, perform Membrane login, create/inspect connections, list actions, run actions, and proxy to the Canva API. The SKILL.md does not instruct reading unrelated files, environment variables, or exfiltrating data to unexpected endpoints.
Install Mechanism
There is no formal install spec in the registry; the SKILL.md instructs users to run `npm install -g @membranehq/cli` (a public npm package). Installing a global npm package runs arbitrary code on the host (moderate risk). Because the CLI is a third-party package, verify its authenticity and reputation before installing; using npx or a sandboxed environment is safer.
Credentials
The skill declares no required environment variables, no secrets, and no config paths. Authentication is delegated to Membrane (browser-based login and managed connections), which is proportionate for a connector that needs access to a user's Canva account.
Persistence & Privilege
The skill is not always-enabled, does not request platform-wide privileges, and does not modify other skills or system-wide configs. The only persistent effect is that the user will create a connection in Membrane (server-side), which is expected for this integration.
Assessment
This skill is internally consistent: it uses the Membrane CLI to access Canva and does not ask for unrelated credentials or special system privileges. Before installing or using it, verify the @membranehq/cli package and the Membrane service: check the npm package publisher, the GitHub repository (https://github.com/membranedev/application-skills referenced in the SKILL.md), and the privacy/permission model on getmembrane.com. Prefer running with npx or in a disposable/sandboxed environment rather than globally installing with -g if you are unsure. Understand that authenticating will grant Membrane access to your Canva account data (stored/handled server-side by Membrane), so confirm you trust that service and review which Canva permissions the connector requests. If you need higher assurance, request the skill author to provide a signed repository/package and a clear maintainer identity.Like a lobster shell, security has layers — review code before you run it.
latestvk973re727f283z94jkxrd008nh845ekd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.