Agent skill · software engineering · jeremylongshore
canva-policy-guardrails
Implement repository and runtime controls for Canva Connect authorization, secrets, previews, data, retries, and CI trust. Use when converting integration policy into testable deny-by-default checks. Trigger with: "add Canva guardrails", "lint Canva integration", "enforce Canva policy".
Why this skill is useful
Adds executable scripts for enforcing Canva API integration policies, including lint rules and pre-commit hooks that automate compliance checks.
What it needs
Requires bash, eslint, pre-commit installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Integration Policy Guardrails Overview Encode high-confidence invariants close to the code and verify them again at runtime. Keep provider-dependent facts versioned so a stale numeric limit or preview assumption cannot become permanent policy. Prerequisites Policy document, owner, enforcement scope, and exception expiry Repository/runtime boundaries and pinned provider contract Current secret, scope, data, CI-event, and preview inventory Instructions Step 1: Classify controls Separate immutable security controls from versioned provider-contract checks and local operational thresholds. Name the authority for each. Step 2: Add secret controls Use Write or Edit to block client secrets/tokens in source, frontend bundles, logs, snapshots, artifacts, and untrusted CI; scan examples and failure paths too. Step 3: Add authorization controls Require tenant/resource ownership, application policy, explicit minimum scopes, current capabilities, and preview status before dispatch. Step 4: Add operation controls Require operation identity for mutations, bounded retry classification, async job reconciliation, and scoped queues for throttling. Step 5: Add contract controls Pin OpenAPI or checksum, test unknown fields/statuses safely, detect deprecated/preview surface drift, and require review before regeneration. Step 6: Add evidence controls Use Read and Grep to verify each rule fires on a failing fixture, cannot be bypassed by formatting, and produces a redacted reason with owner and exception path. Step 7: Govern exceptions Make exceptions narrow, approved, time-bounded, visible in CI, and automatically fail after expiry. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. Request explicit least-privilege scopes, keep client secrets and tokens out of browser-visible state, and serialize refresh so the replacement single-use refresh token is stored atomically. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-policy-guardrails