canva-creator-2b3fbc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited canva-creator-2b3fbc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill handles a campaign in five sequential stages, each gated by owner approval:
brief → calendar → asset inventory → Canva designs → copy → HubSpot staging| Path | Channels | What this skill produces |
|---|---|---|
| Canva (social) | Instagram, Facebook, X/Twitter, LinkedIn | Canva design + caption + scheduled HubSpot post |
| Text-only | Email (newsletter, marketing, drip) | Subject + preheader + body, surfaced inline for the owner to send |
Canva is not used for email rows under any circumstance — no templates, no autofill, no design copies, no asset uploads, no exports. The owner explicitly descoped Canva from the email path because email-template autofill produces placeholder graphics when image slots exceed available photos, and variation thumbnails fail to render in chat previews. If the owner asks for a Canva email design, see reference/gotchas.md for the redirect language.
Before Stage 1, confirm:
"I'll need the content brief before I can build the campaign. Do you have one from the content-strategy skill, or would you like to write one now?"
user's library (no autofill API). Enterprise can autofill from brand templates.
Starter or Free → skip Stage 5 and export a CSV instead (see reference/hubspot-staging.md).
the brand kit is live in Canva.
it before Stage 1 begins. Default is 3 candidates per Canva-bound row; each design costs ~5 API calls (autofill + export + polling).
Generation budget for this campaign:
Canva (social) rows: 8
Candidates per row: 3 (default — say "single candidate" to use 1)
Total designs: 24
API calls (approx): ~120 (autofill + export + polling)
Canva limit: 100 requests/minute. This will take ~2-3 minutes of
generation, well within your tier limits. Proceed?If the projected total designs exceeds 30, recommend single-candidate mode upfront — large campaigns run out of headroom fast. The owner can override the default to 1, 2, or 3 candidates per row before Stage 1 starts. Lock the chosen value for the entire session.
Pull from the brief: content themes, channels, cadence, hard dates (launches, sales, holidays).
Build a calendar table with a Path column that routes every row to either Canva or text-only drafting:
| Date | Channel | Path | Theme | Asset type | Caption/Subject angle |
|---|---|---|---|---|---|
| Jun 2 | Instagram feed | Canva (social) | Linen launch | Square post | "finally, a dress…" |
| Jun 5 | Text-only | Linen launch | Email body | "Linen that actually breathes" |
Tag every email-channel row as Text-only before presenting. Cap at 30 days unless the brief specifies otherwise. Flag scheduling conflicts (two posts same day for the same product) up front.
Checkpoint 1. Present the calendar. Ask: "Does this match the plan? Any dates to shift, channels to add, or themes to swap?" Iterate until approved, then restate the split out loud — "N rows go through Canva, M rows go through text-only drafting" — before moving on. Catching a miscategorization here is free; catching it after generating designs isn't.
Email rows skip this stage entirely. For each Canva (social) row, build a manifest of what the template needs and what's already available.
have 1-2 image slots; carousels and product grids can have 5+. List them individually (Header_Image, Product1_Image, Product2_Image, …) — never roll them up as "product images."
dataset[].label on the brandtemplate (GET /v1/brand-templates/{id}).
names, offer copy, taglines, pricing), product photos already uploaded to Canva (GET /v1/assets) or on the owner's disk, brand kit colors and fonts (Enterprise).
per design.
| Date | Slot name | Slot kind | Available asset | Status |
|---|---|---|---|---|
| Jun 2 | Hero_Image | image | bloom_summer.jpg → asset_id pending | upload |
| Jun 2 | Headline | text | "Summer linen, finally" | ready |
| Jun 9 | Product1_Image | image | — | MISSING |
more image slots than the brief provides photos, pause and ask:
The "Summer Carousel" template has 5 image slots. The brief gave me 1
photo (bloom_summer.jpg). How should I fill the other 4?
1. Reuse the same photo across all 5 slots
2. You send me 4 more photos (file paths)
3. Pick a simpler template with fewer slotsNo generation calls until the owner picks. Generating with empty slots produces designs full of Canva's default landscape placeholders.
POST /v1/asset-uploads, then poll GET /v1/asset-uploads/{job_id} until status == "success". Record asset.id from the response — this is the only value that works in an autofill image field. Passing an empty string, a URL, a file path, or a stale ID silently renders Canva's stock landscape graphic instead of the photo.
table with every slot resolved and every image asset.id confirmed. This is the last stop before Canva API calls.
Before any Canva API call, re-read the calendar and drop any row whose Path is not Canva (social). Email rows do not pass through this stage.
Generate designs one calendar row at a time, with 3 candidates per row (or the value chosen at pre-flight). Each row follows the same loop: generate candidates → verify → export → visually check → retry failures → present → wait for owner pick → next row. Pause 30 seconds between rows. This caps the burst at 3 generations + 3 exports per ~30s — well under Canva's 100 req/min rate limit. Do not parallelize multiple rows; one row at a time is the protection that keeps the owner from hitting quota mid-campaign.
Polling cadence. Poll job status every 3-5 seconds, not faster. Tighter intervals burn quota without speeding up completion.
Preview URLs — only one type is safe to embed. Autofill responses return design.canva.ai thumbnails that expire within minutes; embedding them as markdown images produces broken "Show Image" placeholders. Permanent export URLs (export-download.canva.com or the export-design MCP tool) do not expire. Native Cowork carousels render the autofill result directly using the connector's authenticated session — let them render on their own, don't re-embed.
#### Row loop
unless the calendar mixes asset types.)
GET /v1/brand-templates filtered by asset type.GET /v1/designs?ownership=any&query={template name},surface top 3 to the owner, confirm one before generating.
candidates simultaneously (or N from pre-flight).
POST /v1/autofills per candidate with the template IDand field values. Poll all jobs concurrently.
POST /v1/designs to create copies. Describe the text andimage edits the owner applies in Canva; collect design IDs back.
GET /autofills/{job_id} returned status == "success" and result.design.id is present. Handle errors per-design:
JOB_FAILED → read job.error.message, fix the field values orasset IDs, retry once.
RATE_LIMIT_EXCEEDED (first hit this session) → wait 60s, retrythat one candidate once. This handles transient spikes.
RATE_LIMIT_EXCEEDED (second hit this session) or anyquota_exceeded / daily-cap error → stop generation immediately. Do not retry. Surface progress and ask:
Canva is rate-limiting the campaign. Status so far:
✓ Generated: Posts 1-4 (12 designs)
⏸ Remaining: Posts 5-8 (12 designs not yet generated)
How should I proceed?
1. Switch to 1 candidate per remaining row (4 designs total) — finishes now
2. Pause campaign — resume in 60 minutes when quota refills
3. Stop generation — work with what we have, move to captionsWait for the owner's choice. Do not loop on retry.
row's exports in parallel.
POST /v1/exports with format.type: "png", pollGET /v1/exports/{job_id} until success, capture urls[0].
export-design with the design ID.These permanent URLs are what get embedded in previews and attached to the HubSpot post later. The autofill response thumbnail is never used downstream.
these — they all indicate an unfilled slot or wrong asset:
placeholder)
If a candidate fails verification: re-check the manifest for the affected slot, fix the asset.id, regenerate that single candidate, re-export, re-verify.
the row failed at Step 3 or 5, regenerate just that one — don't redo the whole row and don't present a partial broken carousel. If the second attempt also fails:
The third candidate for the Jun 9 post keeps failing — Canva returned
[error / rendered placeholder]. How should I proceed?
1. Skip it — present the other 2 and move on
2. Swap to a simpler template for just this candidate
3. Try once more with a different photorender the autofill tool result. Below it, add a text prompt:
Jun 9 candidates are ready — scroll through the carousel above.
Which one should I use for the Jun 9 post?If the carousel doesn't render or one position is broken, embed the permanent export PNG URLs from Step 4 instead. Final fallback: link to the design's Canva edit URL (https://www.canva.com/d/{design_id}). Never re-embed design.canva.ai URLs.
Checkpoint 2. Satisfied once the owner has picked one design per calendar row. If they want a regenerate, regenerate only that one candidate.
For each calendar row, draft the copy. Social rows get a caption; email rows get a full email.
Social captions — Instagram, Facebook, X, LinkedIn:
recommended; X ≤ 280).
friendly," don't write corporate copy.
with the value.
Email content — Claude writes the entire email; no Canva:
booking up" beats "Don't miss out!"
1-2 paragraphs of substance → single clear CTA → sign-off.
like them, not like a templated newsletter.
visuals, they add them in their email tool.
Present captions inline below each social row. Present full emails inline below each email row:
Subject: <subject line>
Preheader: <preheader text>
<body text>For worked examples, see reference/examples/boutique-brief-campaign.md.
Checkpoint 3. "Any captions or emails to rewrite? Flag the date and what to change." Iterate until approved.
Stage social posts in HubSpot. Email content is not staged — it's surfaced inline for the owner to copy into their email tool. For API field reference, see reference/hubspot-staging.md.
POST /marketing/v3/campaigns with thecampaign name and start/end dates from the calendar.
POST to the HubSpot Social API perCanva (social) row:
channel: map calendar channel to HubSpot account IDscheduledAt: ISO 8601 datetime — confirm it's in the future beforecalling
content.body: approved captionattachments: permanent Canva export PNG URL from Stage 3status: SCHEDULED (never PUBLISHED)GET /marketing/v3/social/posts?status=SCHEDULED, surface the list, provide a direct link to the HubSpot campaign view.
approved subject + preheader + body inline, grouped by send date. The owner copies these into their email tool (HubSpot Marketing Email, Mailchimp, Gmail).
Final checkpoint.
Your social posts are scheduled in HubSpot: [link]
They'll go out as scheduled — you can cancel or edit any post in HubSpot.
Email content is drafted below — copy each into your email tool when
you're ready to send:
Jun 5 — "Spring projects are booking up"
Jul 15 — "Summer maintenance windows are filling"
Anything to change before we're done?Path column beforeevery API call.
SCHEDULED; theowner controls go-live.
total design count and approves before Stage 1 begins.
parallel, but rows are sequential with a 30s gap — this is the quota protection.
doesn't mean the design rendered correctly.
Per-candidate retry only.
placeholder landscapes when any slot is empty.
is the largest source of wasted work in this skill.
endpoints, asset upload, export formats, MCP equivalents
Social API and CSV fallback for non-Pro tiers
every failure mode this skill has hit in production
— full worked examples (single-slot social, multi-slot template)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.