Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Canvas LMS integration that handles sensitive school data and authentication, so users should install it deliberately, but the inspected artifact does not show hidden, deceptive, or unrelated behavior.
Install only if you are comfortable giving this MCP access to Canvas academic records, inbox content, observed student data, and Canvas session authentication. Prefer the narrowest authentication method you trust, verify the npm package and browser extension source, and confirm before downloading course files to disk.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Add to .mcp.json in your project or ~/.claude/mcp.json:
{
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Alternatives (env-var)
- **Personal access token** — set `CANVAS_TOKEN`. Most institutions have disabled this for non-admins.
- **OAuth** — set `CANVAS_CLIENT_ID`, `CANVAS_CLIENT_SECRET`, `CANVAS_REFRESH_TOKEN`. Bootstrap via `canvas-parent-mcp-qr-login`.
- **Username/password (session-scrape)** — set `CANVAS_USERNAME` + `CANVAS_PASSWORD`. Direct Canvas accounts only (no SSO/2FA). Brittle.
The skill is presented as answering questions about Canvas data, but it also exposes a file-download capability that writes data to local disk. That mismatch can cause users or higher-level agents to invoke the skill under the assumption of read-only behavior, increasing the risk of unintended local side effects and handling of untrusted files.
The activation criteria are broad enough to trigger on many general school-related requests, which can cause over-invocation of a sensitive skill tied to academic records and observer data. In context, that raises privacy risk because the skill can access grades, conversations, and linked student information for observed accounts.
The documentation advertises downloading course files to disk without a prominent warning that this causes a local filesystem write. In a skill context, silent writes of remotely sourced content can expose the host to storage abuse, accidental overwrites, or handling of untrusted files without informed consent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Response shape (`view`)
Nine tools take `view: "compact" | "full"`, and **`compact` is the default** —
you get the slim shape without asking for it:
`canvas_get_profile`, `canvas_list_observees`, `canvas_get_course`,
`canvas_get_submission`, `canvas_list_recent_submissions`,
Describing the server as read-focused is misleading when one tool performs a filesystem write by downloading files locally. Even if the write is constrained, this can bypass user expectations and downstream policy assumptions about the skill being non-mutating.
No suspicious patterns detected.