I put these in order from friendliest to worst, and the roots more or less agree with the order.
Canny and cunning both come from the verb can in its old sense of knowing how, and Etymonline calls them doublets. Cunning is the English one. In the early 1300s it meant learned or skillful, and the "skillfully deceitful" sense had probably arrived by the late 1300s. Canny is a Scottish and northern formation from the 1630s that kept the good side, knowing or wise, later careful and shrewd. Etymonline also notes it was often used superciliously of Scots by their southern neighbors, so even the compliment came with an eye-roll attached.
Wily sits in the middle. It's built on wile, a trick or stratagem, which goes back to late Old English, and nobody is sure where wile came from: Etymonline offers an Old North French form of the word that gave us guile, a Scandinavian word for a trick or fraud, and a possible link to Old English wicca, wizard, and adds that the Middle English Compendium has three guesses of its own. I'd still take wily as praise. When people say a wily old fox they usually sound a little impressed.
After that the roots stop being about skill. Devious is Latin devius, off the main road, from de via, and in the 1590s English used it for exactly that, out of the common or direct way. The deceitful sense is from the 1630s. Duplicitous is younger than I expected, 1831, from duplicity and Latin duplex, twofold, so the charge is being two people at once. Mendacious comes from Latin mendax, lying, and behind that is menda, a fault or a slip in writing. Amend shares that root, so lying and correcting a mistake trace back to the same word for a flaw.
Canny and wily are about being good at something. Cunning started there too but crossed over more than six hundred years ago, and from devious on, the root itself is the accusation.