← Back to Skills Marketplace
coolmanns

Canva Connect

by coolmanns · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
3430
Downloads
3
Stars
11
Active Installs
1
Versions
Install in OpenClaw
/install canva-connect
Description
Manage Canva designs, assets, and folders via the Connect API. WHAT IT CAN DO: - List/search/organize designs and folders - Export finished designs (PNG/PDF/JPG) - Upload images to asset library - Autofill brand templates with data - Create blank designs (doc/presentation/whiteboard/custom) WHAT IT CANNOT DO: - Add content to designs (text, shapes, elements) - Edit existing design content - Upload documents (images only) - AI design generation Best for: asset pipelines, export automation, organization, template autofill. Triggers: /canva, "upload to canva", "export design", "list my designs", "canva folder".
README (SKILL.md)

Canva Connect

Manage Canva designs, assets, and folders via the Connect API.

What This Skill Does (and Doesn't Do)

✅ CAN DO ❌ CANNOT DO
List/search designs Add content to designs
Create blank designs Edit existing design content
Export designs (PNG/PDF/JPG) Upload documents (images only)
Create/manage folders AI design generation
Move items between folders
Upload images as assets
Autofill brand templates

Realistic Use Cases

1. Asset Pipeline 🖼️

Generate diagram → upload to Canva → organize in project folder

2. Export Automation 📤

Design finished in Canva → export via CLI → use in docs/website

3. Design Organization 📁

Create project folders → move related designs → keep Canva tidy

4. Brand Template Autofill 📋

Set up template in Canva → pass data via API → get personalized output

Quick Start

# Authenticate (opens browser for OAuth)
{baseDir}/scripts/canva.sh auth

# List your designs
{baseDir}/scripts/canva.sh designs list

# Create a new design
{baseDir}/scripts/canva.sh designs create --type doc --title "My Document"

# Export a design
{baseDir}/scripts/canva.sh export \x3Cdesign_id> --format pdf

Setup

1. Create Canva Integration

  1. Go to canva.com/developers/integrations
  2. Click Create an integration
  3. Set scopes:
    • design:content (Read + Write)
    • design:meta (Read)
    • asset (Read + Write)
    • brandtemplate:meta (Read)
    • brandtemplate:content (Read)
    • profile (Read)
  4. Set OAuth redirect: http://127.0.0.1:3001/oauth/redirect
  5. Note Client ID and generate Client Secret

2. Configure Environment

Add to ~/.clawdbot/clawdbot.json under skills.entries:

{
  "skills": {
    "entries": {
      "canva": {
        "clientId": "YOUR_CLIENT_ID",
        "clientSecret": "YOUR_CLIENT_SECRET"
      }
    }
  }
}

Or set environment variables:

export CANVA_CLIENT_ID="your_client_id"
export CANVA_CLIENT_SECRET="your_client_secret"

3. Authenticate

{baseDir}/scripts/canva.sh auth

Opens browser for OAuth consent. Tokens stored in ~/.clawdbot/canva-tokens.json.

Commands

Authentication

Command Description
auth Start OAuth flow (opens browser)
auth status Check authentication status
auth logout Clear stored tokens

Designs

Command Description
designs list [--limit N] List your designs
designs get \x3Cid> Get design details
designs create --type \x3Ctype> --title \x3Ctitle> Create new design
designs delete \x3Cid> Move design to trash

Design types: doc, presentation, whiteboard, poster, instagram_post, facebook_post, video, logo, flyer, banner

Export

Command Description
export \x3Cdesign_id> --format \x3Cfmt> Export design
export status \x3Cjob_id> Check export job status

Formats: pdf, png, jpg, gif, pptx, mp4

Assets

Command Description
assets list List uploaded assets
assets upload \x3Cfile> [--name \x3Cname>] Upload asset
assets get \x3Cid> Get asset details
assets delete \x3Cid> Delete asset

Brand Templates

Command Description
templates list List brand templates
templates get \x3Cid> Get template details
autofill \x3Ctemplate_id> --data \x3Cjson> Autofill template with data

Folders

Command Description
folders list List folders
folders create \x3Cname> Create folder
folders get \x3Cid> Get folder contents

User

Command Description
me Get current user profile

Examples

Create and Export a Poster

# Create
{baseDir}/scripts/canva.sh designs create --type poster --title "Event Poster"

# Export as PNG
{baseDir}/scripts/canva.sh export DAF... --format png --output ./poster.png

Upload Brand Assets

# Upload logo
{baseDir}/scripts/canva.sh assets upload ./logo.png --name "Company Logo"

# Upload multiple
for f in ./brand/*.png; do
  {baseDir}/scripts/canva.sh assets upload "$f"
done

Autofill a Template

# List available templates
{baseDir}/scripts/canva.sh templates list

# Autofill with data
{baseDir}/scripts/canva.sh autofill TEMPLATE_ID --data '{
  "title": "Q1 Report",
  "subtitle": "Financial Summary",
  "date": "January 2026"
}'

API Reference

Base URL: https://api.canva.com/rest

See references/api.md for detailed endpoint documentation.

Troubleshooting

Token Expired

{baseDir}/scripts/canva.sh auth  # Re-authenticate

Rate Limited

The API has per-endpoint rate limits. The script handles backoff automatically.

Missing Scopes

If operations fail with 403, ensure your integration has the required scopes enabled.

Data Files

File Purpose
~/.clawdbot/canva-tokens.json OAuth tokens (encrypted)
~/.clawdbot/canva-cache.json Response cache
Usage Guidance
This skill appears to be a real Canva Connect integration, but there are several things you should check before installing or providing credentials: - Verify the owner/source. The 'Source' and 'Homepage' are missing in the registry; prefer skills from a known publisher. - Inspect the included script (scripts/canva.sh) yourself. It will run a local OAuth flow, start a small Python HTTP server to capture the auth code, and write tokens to ~/.clawdbot/canva-tokens.json. Ensure you trust the code before running it. - Confirm required tools are available (curl, jq, openssl, python3). The registry metadata omits these requirements but the script needs them. - Scope/privilege mismatch: the script requests write-capable OAuth scopes (design:content:write, asset:write, folder:write) even though the README claims the skill "cannot add content to designs". If you only need exports/reads, consider creating an OAuth client with minimal (read-only) scopes or do not grant write scopes/secret to this skill. - Prefer setting CANVA_CLIENT_ID and CANVA_CLIENT_SECRET as environment variables in a controlled environment rather than pasting secrets into shared config files. Rotate credentials if you suspect misuse. - If uncertain, run the CLI in an isolated environment (container or VM) to limit blast radius. If you want, I can highlight the exact lines in scripts/canva.sh that request scopes and write tokens so you can more easily review them.
Capability Analysis
Type: OpenClaw Skill Name: canva-connect Version: 1.0.0 The OpenClaw AgentSkills skill bundle for Canva Connect appears benign. The `SKILL.md` provides clear, non-malicious instructions and scope. The `scripts/canva.sh` script handles OAuth authentication, token storage (`~/.clawdbot/canva-tokens.json` with `chmod 600`), and API interactions exclusively with `api.canva.com`. It uses standard tools like `curl`, `jq`, `openssl`, and an embedded Python server for the OAuth callback, all for legitimate purposes aligned with managing Canva designs and assets. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.
Capability Assessment
Purpose & Capability
The skill's stated purpose (Canva Connect: list/export/upload/organize/autofill) matches the included CLI and API references. However, registry metadata incorrectly lists no required environment variables or credentials while SKILL.md declares CANVA_CLIENT_ID and CANVA_CLIENT_SECRET. Also the script requires standard CLI utilities (curl, jq, openssl, python3) even though the manifest claims no required binaries—this metadata mismatch is confusing and should be corrected.
Instruction Scope
SKILL.md and scripts instruct the agent/user to run scripts that: open the browser for OAuth, start a local Python HTTP server to capture the auth code, read ~/.clawdbot/clawdbot.json for credentials, and write tokens to ~/.clawdbot/canva-tokens.json. Those steps are expected for OAuth CLI tools, but the script explicitly requests write-capable scopes (e.g., design:content:write, asset:write, folder:write) even though the SKILL.md 'WHAT IT CANNOT DO' claims it cannot add/edit design content. That is a contradiction: the runtime will request more privileges than the description promises.
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded at install time. However a non-trivial shell script is included and will be written/executed if the skill is used. The script relies on external binaries (curl, jq, openssl, python3) which are not declared in the top-level registry requirements—this is an omission rather than a direct install risk, but users should ensure those tools are available and review the script before running it.
Credentials
The only required credentials are Canva client ID/secret (appropriate for OAuth). But the OAuth scopes requested by the script include write permissions for design content and assets. Those scopes are broader than the SKILL.md's claimed limitations (it says it cannot add or edit design content). Requesting client_secret + broad write scopes is a privilege expansion that users should be wary of.
Persistence & Privilege
The skill does not request global 'always' presence and does not modify other skills. It stores OAuth tokens in ~/.clawdbot/canva-tokens.json with chmod 600, and uses a local HTTP server to complete OAuth — this is normal for CLI OAuth flows. Autonomous invocation is allowed (platform default) and is not by itself a red flag.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install canva-connect
  3. After installation, invoke the skill by name or use /canva-connect
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: design management, asset uploads, folder organization, export automation
Metadata
Slug canva-connect
Version 1.0.0
License
All-time Installs 11
Active Installs 11
Total Versions 1
Frequently Asked Questions

What is Canva Connect?

Manage Canva designs, assets, and folders via the Connect API. WHAT IT CAN DO: - List/search/organize designs and folders - Export finished designs (PNG/PDF/JPG) - Upload images to asset library - Autofill brand templates with data - Create blank designs (doc/presentation/whiteboard/custom) WHAT IT CANNOT DO: - Add content to designs (text, shapes, elements) - Edit existing design content - Upload documents (images only) - AI design generation Best for: asset pipelines, export automation, organization, template autofill. Triggers: /canva, "upload to canva", "export design", "list my designs", "canva folder". It is an AI Agent Skill for Claude Code / OpenClaw, with 3430 downloads so far.

How do I install Canva Connect?

Run "/install canva-connect" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Canva Connect free?

Yes, Canva Connect is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Canva Connect support?

Canva Connect is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Canva Connect?

It is built and maintained by coolmanns (@coolmanns); the current version is v1.0.0.

💬 Comments