← 返回 Skills 市场
coolmanns

Canva Connect

作者 coolmanns · GitHub ↗ · v1.0.0
cross-platform ⚠ suspicious
3430
总下载
3
收藏
11
当前安装
1
版本数
在 OpenClaw 中安装
/install canva-connect
功能描述
Manage Canva designs, assets, and folders via the Connect API. WHAT IT CAN DO: - List/search/organize designs and folders - Export finished designs (PNG/PDF/JPG) - Upload images to asset library - Autofill brand templates with data - Create blank designs (doc/presentation/whiteboard/custom) WHAT IT CANNOT DO: - Add content to designs (text, shapes, elements) - Edit existing design content - Upload documents (images only) - AI design generation Best for: asset pipelines, export automation, organization, template autofill. Triggers: /canva, "upload to canva", "export design", "list my designs", "canva folder".
使用说明 (SKILL.md)

Canva Connect

Manage Canva designs, assets, and folders via the Connect API.

What This Skill Does (and Doesn't Do)

✅ CAN DO ❌ CANNOT DO
List/search designs Add content to designs
Create blank designs Edit existing design content
Export designs (PNG/PDF/JPG) Upload documents (images only)
Create/manage folders AI design generation
Move items between folders
Upload images as assets
Autofill brand templates

Realistic Use Cases

1. Asset Pipeline 🖼️

Generate diagram → upload to Canva → organize in project folder

2. Export Automation 📤

Design finished in Canva → export via CLI → use in docs/website

3. Design Organization 📁

Create project folders → move related designs → keep Canva tidy

4. Brand Template Autofill 📋

Set up template in Canva → pass data via API → get personalized output

Quick Start

# Authenticate (opens browser for OAuth)
{baseDir}/scripts/canva.sh auth

# List your designs
{baseDir}/scripts/canva.sh designs list

# Create a new design
{baseDir}/scripts/canva.sh designs create --type doc --title "My Document"

# Export a design
{baseDir}/scripts/canva.sh export \x3Cdesign_id> --format pdf

Setup

1. Create Canva Integration

  1. Go to canva.com/developers/integrations
  2. Click Create an integration
  3. Set scopes:
    • design:content (Read + Write)
    • design:meta (Read)
    • asset (Read + Write)
    • brandtemplate:meta (Read)
    • brandtemplate:content (Read)
    • profile (Read)
  4. Set OAuth redirect: http://127.0.0.1:3001/oauth/redirect
  5. Note Client ID and generate Client Secret

2. Configure Environment

Add to ~/.clawdbot/clawdbot.json under skills.entries:

{
  "skills": {
    "entries": {
      "canva": {
        "clientId": "YOUR_CLIENT_ID",
        "clientSecret": "YOUR_CLIENT_SECRET"
      }
    }
  }
}

Or set environment variables:

export CANVA_CLIENT_ID="your_client_id"
export CANVA_CLIENT_SECRET="your_client_secret"

3. Authenticate

{baseDir}/scripts/canva.sh auth

Opens browser for OAuth consent. Tokens stored in ~/.clawdbot/canva-tokens.json.

Commands

Authentication

Command Description
auth Start OAuth flow (opens browser)
auth status Check authentication status
auth logout Clear stored tokens

Designs

Command Description
designs list [--limit N] List your designs
designs get \x3Cid> Get design details
designs create --type \x3Ctype> --title \x3Ctitle> Create new design
designs delete \x3Cid> Move design to trash

Design types: doc, presentation, whiteboard, poster, instagram_post, facebook_post, video, logo, flyer, banner

Export

Command Description
export \x3Cdesign_id> --format \x3Cfmt> Export design
export status \x3Cjob_id> Check export job status

Formats: pdf, png, jpg, gif, pptx, mp4

Assets

Command Description
assets list List uploaded assets
assets upload \x3Cfile> [--name \x3Cname>] Upload asset
assets get \x3Cid> Get asset details
assets delete \x3Cid> Delete asset

Brand Templates

Command Description
templates list List brand templates
templates get \x3Cid> Get template details
autofill \x3Ctemplate_id> --data \x3Cjson> Autofill template with data

Folders

Command Description
folders list List folders
folders create \x3Cname> Create folder
folders get \x3Cid> Get folder contents

User

Command Description
me Get current user profile

Examples

Create and Export a Poster

# Create
{baseDir}/scripts/canva.sh designs create --type poster --title "Event Poster"

# Export as PNG
{baseDir}/scripts/canva.sh export DAF... --format png --output ./poster.png

Upload Brand Assets

# Upload logo
{baseDir}/scripts/canva.sh assets upload ./logo.png --name "Company Logo"

# Upload multiple
for f in ./brand/*.png; do
  {baseDir}/scripts/canva.sh assets upload "$f"
done

Autofill a Template

# List available templates
{baseDir}/scripts/canva.sh templates list

# Autofill with data
{baseDir}/scripts/canva.sh autofill TEMPLATE_ID --data '{
  "title": "Q1 Report",
  "subtitle": "Financial Summary",
  "date": "January 2026"
}'

API Reference

Base URL: https://api.canva.com/rest

See references/api.md for detailed endpoint documentation.

Troubleshooting

Token Expired

{baseDir}/scripts/canva.sh auth  # Re-authenticate

Rate Limited

The API has per-endpoint rate limits. The script handles backoff automatically.

Missing Scopes

If operations fail with 403, ensure your integration has the required scopes enabled.

Data Files

File Purpose
~/.clawdbot/canva-tokens.json OAuth tokens (encrypted)
~/.clawdbot/canva-cache.json Response cache
安全使用建议
This skill appears to be a real Canva Connect integration, but there are several things you should check before installing or providing credentials: - Verify the owner/source. The 'Source' and 'Homepage' are missing in the registry; prefer skills from a known publisher. - Inspect the included script (scripts/canva.sh) yourself. It will run a local OAuth flow, start a small Python HTTP server to capture the auth code, and write tokens to ~/.clawdbot/canva-tokens.json. Ensure you trust the code before running it. - Confirm required tools are available (curl, jq, openssl, python3). The registry metadata omits these requirements but the script needs them. - Scope/privilege mismatch: the script requests write-capable OAuth scopes (design:content:write, asset:write, folder:write) even though the README claims the skill "cannot add content to designs". If you only need exports/reads, consider creating an OAuth client with minimal (read-only) scopes or do not grant write scopes/secret to this skill. - Prefer setting CANVA_CLIENT_ID and CANVA_CLIENT_SECRET as environment variables in a controlled environment rather than pasting secrets into shared config files. Rotate credentials if you suspect misuse. - If uncertain, run the CLI in an isolated environment (container or VM) to limit blast radius. If you want, I can highlight the exact lines in scripts/canva.sh that request scopes and write tokens so you can more easily review them.
功能分析
Type: OpenClaw Skill Name: canva-connect Version: 1.0.0 The OpenClaw AgentSkills skill bundle for Canva Connect appears benign. The `SKILL.md` provides clear, non-malicious instructions and scope. The `scripts/canva.sh` script handles OAuth authentication, token storage (`~/.clawdbot/canva-tokens.json` with `chmod 600`), and API interactions exclusively with `api.canva.com`. It uses standard tools like `curl`, `jq`, `openssl`, and an embedded Python server for the OAuth callback, all for legitimate purposes aligned with managing Canva designs and assets. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent.
能力评估
Purpose & Capability
The skill's stated purpose (Canva Connect: list/export/upload/organize/autofill) matches the included CLI and API references. However, registry metadata incorrectly lists no required environment variables or credentials while SKILL.md declares CANVA_CLIENT_ID and CANVA_CLIENT_SECRET. Also the script requires standard CLI utilities (curl, jq, openssl, python3) even though the manifest claims no required binaries—this metadata mismatch is confusing and should be corrected.
Instruction Scope
SKILL.md and scripts instruct the agent/user to run scripts that: open the browser for OAuth, start a local Python HTTP server to capture the auth code, read ~/.clawdbot/clawdbot.json for credentials, and write tokens to ~/.clawdbot/canva-tokens.json. Those steps are expected for OAuth CLI tools, but the script explicitly requests write-capable scopes (e.g., design:content:write, asset:write, folder:write) even though the SKILL.md 'WHAT IT CANNOT DO' claims it cannot add/edit design content. That is a contradiction: the runtime will request more privileges than the description promises.
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded at install time. However a non-trivial shell script is included and will be written/executed if the skill is used. The script relies on external binaries (curl, jq, openssl, python3) which are not declared in the top-level registry requirements—this is an omission rather than a direct install risk, but users should ensure those tools are available and review the script before running it.
Credentials
The only required credentials are Canva client ID/secret (appropriate for OAuth). But the OAuth scopes requested by the script include write permissions for design content and assets. Those scopes are broader than the SKILL.md's claimed limitations (it says it cannot add or edit design content). Requesting client_secret + broad write scopes is a privilege expansion that users should be wary of.
Persistence & Privilege
The skill does not request global 'always' presence and does not modify other skills. It stores OAuth tokens in ~/.clawdbot/canva-tokens.json with chmod 600, and uses a local HTTP server to complete OAuth — this is normal for CLI OAuth flows. Autonomous invocation is allowed (platform default) and is not by itself a red flag.
如何使用
  1. 确保已安装 OpenClaw(本地或 Docker 部署)
  2. 在对话框中输入安装命令:/install canva-connect
  3. 安装完成后,直接呼叫该 Skill 的名称或使用 /canva-connect 触发
  4. 根据 Skill 的参数说明提供必要输入,即可获得结构化输出
版本历史
v1.0.0
Initial release: design management, asset uploads, folder organization, export automation
元数据
Slug canva-connect
版本 1.0.0
许可证
累计安装 11
当前安装数 11
历史版本数 1
常见问题

Canva Connect 是什么?

Manage Canva designs, assets, and folders via the Connect API. WHAT IT CAN DO: - List/search/organize designs and folders - Export finished designs (PNG/PDF/JPG) - Upload images to asset library - Autofill brand templates with data - Create blank designs (doc/presentation/whiteboard/custom) WHAT IT CANNOT DO: - Add content to designs (text, shapes, elements) - Edit existing design content - Upload documents (images only) - AI design generation Best for: asset pipelines, export automation, organization, template autofill. Triggers: /canva, "upload to canva", "export design", "list my designs", "canva folder". 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件,目前累计下载 3430 次。

如何安装 Canva Connect?

在 OpenClaw 或 Claude Code 对话框中运行命令「/install canva-connect」即可一键安装,无需额外配置。

Canva Connect 是免费的吗?

是的,Canva Connect 完全免费(开源免费),可自由下载、安装和使用。

Canva Connect 支持哪些平台?

Canva Connect 跨平台运行,可在任意部署了 OpenClaw / Claude Code 的环境中使用(cross-platform)。

谁开发了 Canva Connect?

由 coolmanns(@coolmanns)开发并维护,当前版本 v1.0.0。

💬 留言讨论