ClawHub
Back to skill

Security audit

Canva Automation

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Canva automation helper with expected third-party Canva/Rube access, but users should treat uploaded assets and export links as sensitive.

Install only if you intend to connect Rube MCP to Canva and let the agent act on Canva designs. Review each upload, export, folder move, or autofill request before running it, and treat uploaded files, design contents, OAuth access, and generated download links as sensitive third-party data flows.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to upload assets to Canva, a third-party service, but does not warn that files and their contents will be transferred off-platform and processed by Canva. This can lead users to unintentionally disclose sensitive images, documents, or metadata, especially because the workflow is presented as routine automation without any privacy or consent checkpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The export workflow describes generating downloadable links for Canva designs but does not warn that design content is processed by Canva and then exposed through retrievable download URLs. Even if links are temporary, users may not realize exported content becomes accessible through URL distribution, creating risks of unintended sharing or leakage of sensitive design material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.