canva
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with official Canva domains (
api.canva.com,mcp.canva.com) and follows standard OAuth 2.0 with PKCE protocols for secure authentication. - [SAFE]: Sensitive data such as access tokens, client secrets, and verifiers are handled via environment variables and placeholders, adhering to secure secret management practices.
- [COMMAND_EXECUTION]: The instructions include commands for configuring the MCP environment using
claude mcp addandnpx mcp-remote. These are standard administrative operations for setting up AI agent extensions and do not indicate malicious intent. - [EXTERNAL_DOWNLOADS]: The skill references an example asset URL (
cdn.acme.dev) and official Canva endpoints for design automation. These references are consistent with the skill's primary purpose of design management and asset uploading.
Audit Metadata