OpenAI Codex security directory

Canva

Published by Canva Pty Ltd.

High risk

Connects Codex to Canva to create, edit and review designs. Apply feedback, translate or resize assets, and check branding. Requires a Canva account; bulk creation needs an eligible Enterprise plan.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

Deletes elements in user designs and commits without per-commit confirmation: Can delete records, files, projects, messages, or resources that may be difficult to recover.
Fetches user-supplied URLs and uploads to Canva: Can send prompts, files, queries, or connected-service data to an external service.
Creates, edits, resizes, autofills and translates designs: Can create or change persistent records, files, projects, permissions, settings, or credentials.
OAuth grant to Canva account held by host: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
Replies to design comment threads as the user: Can send messages, comments, invitations, posts, or published content attributed to the connected user.

Available capabilities

This add-on exposes 8 tools or capabilities.

canva-brand-check
canva-branded-presentation
canva-bulk-create
canva-design-feedback
canva-edit-design
canva-implement-feedback
canva-resize-for-social-media
canva-translate-design

The interactive security report will load automatically.