Agent skill · software engineering · jeremylongshore
canva-prod-checklist
Gate a Canva Connect release on authorization, review eligibility, data controls, async recovery, observability, and rollback evidence. Use when promoting a backend integration or enabling a new Canva operation. Trigger with: "Canva production checklist", "release Canva integration", "Canva go-live review".
Why this skill is useful
Adds an executable script for verifying Canva API connectivity and production readiness that isn't in public docs.
What it needs
Requires bash, curl installed locally. Requires canva account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Canva Production Readiness Gate Overview Make go-live an evidence decision tied to an immutable artifact. Preview features, broad scopes, unsafe callback hosts, ambiguous jobs, or unverifiable rollback keep the release closed. Prerequisites Release digest, configuration version, owner, and change scope Production integration, exact redirects, explicit scopes, and feature statuses Test receipts, migrations, observability, data policy, incident plan, and rollback Instructions Step 1: Verify identity and trust Use Read and Grep to confirm exact artifact, environment, integration ID, callback hosts, backend-only secrets, CI event boundaries, and operator ownership. Step 2: Verify authorization Review minimum explicit scopes, tenant/resource checks, capabilities, consent changes, disconnect cleanup, and token-refresh serialization. Step 3: Verify provider contracts Pin current OpenAPI/changelog, identify deprecated and preview APIs, and confirm public-review eligibility. Canva states public integrations using preview features cannot pass review. Step 4: Verify operations Prove operation identity, bounded retry, endpoint/user queueing, async job reconciliation, webhook idempotency if used, and partial-failure cleanup. Step 5: Verify data and telemetry Prove content/credential classification, retention/deletion, URL handling, log redaction, low-cardinality metrics, alert ownership, and debug-bundle expiry. Step 6: Exercise failure and rollback Use Write or Edit to record mocked failures, protected read-only integration proof, migration recovery, rollback command/path, and post-rollback reconciliation. Step 7: Approve or refuse Record exact evidence, approver, residual risks, and activation steps. Refuse if any required fact is inferred rather than proven. Authentication Canva Connect calls use Bearer access tokens obtained by a backend through OAuth 2.0 Authorization Code with SHA-256 PKCE. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/canva-prod-checklist--f2a6fa