Agent skill · software engineering · jeremylongshore
canva-known-pitfalls
Analyze a Canva Connect implementation for recurring authorization, async-job, preview, data, and retry hazards. Use when reviewing code, preparing release, or investigating repeated failures. Trigger with: "review Canva pitfalls", "audit Canva integration", "find Canva anti-patterns".
Why this skill is useful
Provides specific anti-patterns and best practices for integrating with the Canva Connect API that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Integration Hazard Review Overview Turn common failure patterns into evidence-backed findings rather than universal rules. Reconfirm time-sensitive provider behavior against current first-party contracts before enforcing it. Prerequisites Repository scope, deployment/config version, and operation inventory Pinned OpenAPI, current docs, granted scopes, and preview surfaces Data policy, operation ledger, and redacted incident evidence Instructions Step 1: Review OAuth Use Read and Grep to find browser-side secrets, missing state/PKCE validation, broad or implied scopes, refresh races, token logging, and incomplete disconnect cleanup. Step 2: Review authorization Check tenant and resource ownership, application role, explicit scopes, capabilities, and preview availability before every Canva-side action. Step 3: Review async work Find request handlers that block on long polling, lost job IDs, unbounded loops, duplicate submissions, and retries that do not reconcile existing state. Step 4: Review throttling Find guessed global quotas, fixed sleeps, assumed response headers, cross-tenant queues, and missing endpoint/user isolation. Step 5: Review data and telemetry Find cached signed URLs, retained content without purpose, token/profile logs, high-cardinality labels, and debug bundles without expiry or review. Step 6: Review release posture Find unpinned provider contracts, preview features on public-review paths, mutable deploys, missing rollback, and live CI on untrusted events. Step 7: Record dispositions Use Write or Edit to classify each finding with exact path/evidence, current provider source, severity, owner, safe fix, rollback, and verification test. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-known-pitfalls