canva-multi-env-setup
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows security best practices for handling sensitive configurations.
- Environment Isolation: It provides clear instructions and code guards to prevent cross-contamination between development, staging, and production environments, specifically recommending separate OAuth clients and distinct secret storage.
- Secret Management: Instead of encouraging hardcoded credentials, the skill provides specific commands for injecting secrets into secure stores using
aws,gcloud,vault, andgh(GitHub CLI), all of which are explicitly listed in the frontmatter'sallowed-tools. - Placeholder Usage: The credential examples provided (e.g.,
OCA_dev_xxxxxxxx) are clearly identifiable placeholders and do not represent actual leaked secrets. - Trusted Resources: The external links provided are to official Canva developer documentation and the industry-standard 12-Factor App methodology.
Audit Metadata