canvas-parent-api

• Outcome: Review
• Latest audit: Oct 16, 2026 · 10:28 AM UTC
• Version: 2.1.10

Overview

The skill mostly documents Canvas API calls, but its login setup can expose reusable Canvas credentials if the helper or shell session is not trusted.

Review before installing. Use only with a trusted Canvas tenant and avoid running the eval/npx login line unless you trust the package source and version; prefer a pinned helper or manually verified credential export. Treat CANVAS_TOKEN, CANVAS_CLIENT_SECRET, and CANVAS_REFRESH_TOKEN as secrets, avoid shared terminals and logs, and validate Canvas file URLs and output paths before downloading files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: canvas-parent-api
description: "Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and files for yourself or a linked observee. Use when you want Canvas data without the MCP, in a script, or on a machine where the MCP isn't installed."
---

# Canvas LMS via curl (no MCP)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

---
name: canvas-parent-api
description: "Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and files for yourself or a linked observee. Use when you want Canvas data without the MCP, in a script, or on a machine where the MCP isn't installed."
---

# Canvas LMS via curl (no MCP)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

---
name: canvas-parent-api
description: "Query Canvas LMS (Instructure) from a shell with curl and a bearer access token instead of running the canvas-parent-mcp server — courses, grades, assignments, submissions, calendar, planner, announcements, conversations, discussions, and files for yourself or a linked observee. Use when you want Canvas data without the MCP, in a script, or on a machine where the MCP isn't installed."
---

# Canvas LMS via curl (no MCP)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

A. Personal access token (simplest, if allowed)

Canvas web UI → Account → Settings → + New Access Token. Most institutions disable this for non-admins, so try B if it's not offered.

sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill tells users to eval stdout from a package-run helper into their shell, causing client ID, client secret, refresh token, and base URL to be injected as environment variables. This combines secret handling with dynamic code execution, so a compromised helper or manipulated output could both steal credentials and execute arbitrary shell commands in the user's session.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

eval "$(npx canvas-parent-mcp-qr-login "" | sed 's/^/export /')"

text

Then mint (and later re-mint) a short-lived access token from the refresh
token with `curl` directly — no need to re-scan the QR each time:

```sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The instruction to export the minted access token into CANVAS_TOKEN continues the pattern of storing sensitive bearer credentials in the shell environment without warning. Environment variables are commonly exposed to child processes, debugging tools, crash reports, and shared terminal practices, increasing the chance of credential leakage.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

| jq -r '.access_token'

text

Export the result as `CANVAS_TOKEN` (access tokens expire in ~1h — re-run
this when calls start 401ing).

## Core call pattern

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documented flow handles highly sensitive Canvas credentials including client secret, refresh token, and access token, then exports them directly into the shell environment and emits values via stdout. Without an explicit warning, users may expose secrets through shell history, process inspection, logs, terminal scrollback, or accidental copy/paste into shared sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to execute npx canvas-parent-mcp-qr-login without pinning a specific package version or integrity hash. That allows the latest published package to be fetched and executed at runtime, creating a supply-chain execution risk if the package is compromised, typosquatted, or updated maliciously.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

token with curl directly — no need to re-scan the QR each time:

sh

curl -s -X POST "$CANVAS_BASE_URL/login/oauth2/token" \
  -d grant_type=refresh_token \
  -d client_id="$CANVAS_CLIENT_ID" \
  -d client_secret="$CANVAS_CLIENT_SECRET" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/canvas-endpoints.md (reported line 98)May include surrounding context.

8. Recent graded submissions in a course

student_ids[] defaults to self; graded_since defaults to 14 days ago (ISO 8601, compute it yourself for curl — Canvas doesn't).

sh

since=$(date -u -v-14d +%Y-%m-%dT%H:%M:%SZ)   # macOS date; use `date -u -d '14 days ago' ...` on GNU

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs users to download a remote file to local disk and explicitly follow redirects with curl -L, but it does not present a clear upfront warning that data will be written locally and may be fetched from an external storage backend. In a security-sensitive agent skill, this can lead to unintended persistence of sensitive student data and trust of redirected destinations without explicit user awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The documented command sends a bearer token to a URL taken from FILE_URL and follows redirects with -L to an external file storage backend. Although this is expected Canvas behavior, it is still security-relevant because misuse of an unvalidated URL could expose the token to an unintended host or download untrusted content to disk.

Content

Scanner excerpt · references/canvas-endpoints.md (reported line 216)May include surrounding context.

fully-qualified, Bearer-authable Canvas URL (no /api/v1 prefix needed):

sh

curl -sL -H "Authorization: Bearer $CANVAS_TOKEN" "$FILE_URL" -o /path/to/destination.pdf

-L follows Canvas's redirect to the actual file storage backend. The MCP's

Static analysis

No suspicious patterns detected.