canva-2
What this skill does
This skill provides an interface for interacting with Canva's API via MCP (Machine Connector Protocol), allowing users to perform actions like uploading assets, managing designs, commenting, and expor
github/leoyeai - OAuth Misconfiguration - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=canva-2Assessments (2)
OAuth Misconfiguration
OAuth Misconfiguration via local-llm-review
app.py
The `auth` parameter in the `CanvaApp` class is optional and allows passing a custom OAuth provider. This could be a risk if the `auth` parameter is not properly validated or if it allows the use of iInsecure Default Behavior
Insecure Default Behavior via local-llm-review
app.py
The `CanvaApp` class uses a default `OAuth()` instance if no `auth` is provided. This could be a risk if the default OAuth implementation is not secure or if it does not properly handle token persisteBadge
Add the Anomity scan badge for canva-2 to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of canva-2? Report an issue or request a rescan.
