ClawHub
Back to skill

Security audit

Canva

Security checks for vulnerabilities and agentic risk

Overview

This Canva skill is a disclosed pass-through that stores Canva OAuth tokens locally and can change Canva content only through the connected account.

Install only if you are comfortable granting this skill access to act through your Canva account or team permissions. Review the setup scripts, use fresh OAuth credentials, avoid sending unrelated sensitive content to Canva tool calls, and revoke the Canva grant when you no longer need it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this skill is a thin pass-through to Canva's official MCP server for user-facing Canva resource operations. The supplied code does not search, read, or manage Canva designs or related Canva assets at all. Instead, it initializes OAuth state for an MCP server by extracting token and client credential values from environment variables and storing them in mcporter's vault. That is a materially different primary purpose and an undeclared capability involving credential handling and auth provisioning. While this could be supporting infrastructure for MCP access, the code chunk itself is specifically about OAuth vault seeding for generic MCP servers, not Canva design management behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md
- `MAVERICK_CANVA_MCP_EXPIRES_IN`
- `MAVERICK_CANVA_MCP_REFRESH_TOKEN_EXPIRES_AT`

These expiry fields are vault metadata, not tool arguments. They let mcporter make better pre-request refresh decisions for the access token and preserve refresh-token expiry information when the upstream OAuth response includes it.

**Setup-time prerequisites.** Setup needs `bash`, `jq`, and `mcporter` (>= v0.11.0) on `PATH`. These are gated by the install caller, not by `requires.bins` in this file, which gates agent-runtime eligibility. If setup fails, verify those binaries are present and current before retrying.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The skill instructs the agent to discover the live tool catalog from a remote server and then call any advertised tool as authoritative. That creates a broad dynamic trust boundary: if the Canva MCP server exposes unexpected write-capable or high-impact tools, the agent may invoke them without any local allowlist or capability restriction beyond general prose guidance.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

The output includes the server's Instructions: field, if published, and a JSON Schema for every tool's parameters. Treat this as the authoritative reference for the rest of the session.

Step 2 — Call any tool from the catalog using the form maverick-canva-mcp.<tool>:

sh
mcporter --config {baseDir}/mcporter.json call maverick-canva-mcp.<tool> <arg>=<value> ...

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/init-mcporter-oauth.sh:77