Tmp.TZBLh1MWPh

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:55 AM UTC
• Version: 1.1.8

Overview

This Canvas skill is coherent but should be reviewed carefully because it recommends unpinned third-party MCP code and browser-session cookie access to sensitive student data.

Install only if you trust the external MCP package and fetchproxy extension. Prefer pinned, reviewed versions and scoped OAuth credentials over browser session cookies or passwords, avoid storing secrets in project-local MCP config, and download Canvas files only to an intentional safe location.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Automatic Execution of Unpinned Third-Party Code

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:33

Finding

Broad Access to Reusable Canvas Browser Session Cookies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Plaintext Storage of Canvas Credentials in MCP Configuration

Content

View full analysis

username/password > OAuth > fetchproxy. Set `CANVAS_DISABLE_FETCHPROXY=1` to opt out of the fallback. ``` ### Technical Analysis The instructions tell users to add access tokens, OAuth client secrets, refresh tokens, or account passwords to the MCP configuration's `env` block. This commonly results in plaintext secrets being stored in `.mcp.json`. The Skill permits project-local configuration as well as `~/.claude/mcp.json`. A project-local `.mcp.json` is particularly vulnerable to accidental source-control commits, sharing, backup synchronization, archival, or disclosure to other users and tools that can read the project. A global configuration may also be exposed if its filesystem permissions are not restricted. The documented precedence can worsen unintended exposure: when several methods are configured, higher-authority credentials may remain present even if the user expects OAuth or fetchproxy to be used. Username/password authentication also gives the process reusable primary crede ...[truncated 1386 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions are extremely broad, covering nearly any request related to Canvas, grades, conversations, files, or any observed student. Over-broad activation increases the chance the skill is invoked with sensitive educational data or file actions when a narrower, less-privileged skill would suffice, raising privacy and authorization risks.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Option A — npx (recommended)

Add to .mcp.json in your project or ~/.claude/mcp.json:

json

{

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it reads active browser session cookies and credential artifacts from a signed-in Canvas tab, yet provides no prominent privacy or security warning. Session-cookie harvesting from a browser context is highly sensitive because it can silently grant access to protected student or parent data without the user understanding the scope of access.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

### Alternatives (env-var)

- **Personal access token** — set `CANVAS_TOKEN`. Most institutions have disabled this for non-admins.
- **OAuth** — set `CANVAS_CLIENT_ID`, `CANVAS_CLIENT_SECRET`, `CANVAS_REFRESH_TOKEN`. Bootstrap via `canvas-parent-mcp-qr-login`.
- **Username/password (session-scrape)** — set `CANVAS_USERNAME` + `CANVAS_PASSWORD`. Direct Canvas accounts only (no SSO/2FA). Brittle.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is presented as a read-oriented Canvas assistant, but its documented toolset includes canvas_download_file(url, destinationPath), which can write files to the local filesystem. That mismatch can cause users or orchestrators to invoke the skill in contexts where disk writes were not expected, increasing the chance of unsafe file placement or unintended persistence of downloaded content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation advertises canvas_download_file(url, destinationPath) without a clear warning that it writes to local disk and may persist potentially sensitive educational documents. In an agent setting, undisclosed write behavior can lead to accidental storage of private course materials or writing to unsafe paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.