The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to make web requests and jq to parse the resulting JSON data. These operations are standard, non-malicious, and necessary for communicating with the Canva API.
[EXTERNAL_DOWNLOADS]: Network operations are performed against api.canva.com. As Canva is a well-known service, these references are documented neutrally and do not escalate the security risk.
[CREDENTIALS_UNSAFE]: The skill utilizes the CANVA_TOKEN environment variable for authentication, which is specified in the vm0_secrets frontmatter. This follows the platform's secure design for credential injection rather than hardcoding sensitive information.

canva