canvas-parent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:43 AM UTC
• Version: 1.5.6

Overview

This Canvas skill is purpose-aligned, but it asks users to run unpinned external code and reuse sensitive Canvas session or account credentials.

Review this before installing. Use a pinned reviewed package version or commit, avoid project-level config files for secrets, prefer the narrowest institution-approved OAuth/token flow over browser-cookie or password reuse, and only allow file downloads to trusted paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Package Download and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-29` and `SKILL.md:37-42` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```json Add to `.mcp.json` in your project or `~/.claude/mcp.json`: { "mcpServers": { "canvas": { "command": "npx", "args": ["-y", "canvas-parent-mcp"], "env": { "CANVAS_BASE_URL": "https://cms.instructure.com" } } } } ``` The alternative installation method is also unpinned: ```bash git clone https://github.com/chrischall/canvas-parent-mcp cd canvas-parent-mcp npm install && npm run build ``` ### Technical Analysis The recommended configuration invokes `npx -y canvas-parent-mcp` without specifying an exact package version or integrity value. Consequently, the package version resolved when the MCP server starts may differ from the version that was originally reviewed. The `-y` option automatically accepts package installation, reducing the opportunity for the user to inspect the resolved package before execution. The source-based installation method similarly clones the current repository head rather than a reviewed commit or signed release. Running `npm install` also introduces transitive npm dependencies whose security and integrity cannot be evaluated from this project because the audited artifact contains only `SKILL.md`. This is a supply-chain weakness rather than evidence that the current upstream package is malicious. The external package's implementation was not included in the audit and therefore could not be independently verified. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the source repository, or a transitive dependency. 2. The attacker publishes a modified package version or changes the repository head. 3. A user starts the configured MCP server or performs the documented source installation. 4. `npx` downloads the currently resolved package, or the user clo ...[truncated 948 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `canvas-parent-mcp` to an exact, reviewed version rather than resolving the latest release: ```json "args": ["-y", "canvas-parent-mcp@<reviewed-version>"] ``` 2. Record and verify package integrity and provenance where supported. 3. For source installation, check out a specific reviewed commit or signed release tag instead of the repository head. 4. Commit and enforce a dependency lockfile for source builds, and use deterministic installation such as `npm ci`. 5. Review package and transitive-dependency updates before deployment rather than updating automatically. 6. Remove automatic acceptance with `-y` where practical so package resolution remains visible to the user. 7. Run the MCP server in a sandbox with restricted filesystem, environment, and network permissions. 8. Expose only the secrets required by the selected authentication mode to the MCP process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30
• Finding: Plaintext Canvas Credentials and Broad Browser Session Access< installed and a signed-in Canvas tab, that's enough — the MCP reads your session cookies at startup. Add `CANVAS_TOKEN`, `CANVAS_CLIENT_*`/`CANVAS_REFRESH_TOKEN`, or `CANVAS_USERNAME`/`CANVAS_PASSWORD` to the `env` block if you'd rather use one of those modes. ``` The authentication section further documents: ```text **fetchproxy fallback (recommended, zero-config).** Set only `CANVAS_BASE_URL`. Install the [fetchproxy](https://github.com/chrischall/fetchproxy) browser extension, sign into your Canvas instance once. The MCP reads `canvas_session` + `pseudonym_credentials` cookies from your tab at startup; all API calls go directly from Node after that. Works with any auth flow (SSO/SAML/2FA included). ### Alternatives (env-var) - **Personal access token** — set `CANVAS_TOKEN`. Most institutions have disabled this for non-admins. - **OAuth** — set `CANVAS_CLIENT_ID`, `CANVAS_CLIENT_SECRET`, `CANVAS_REFRESH_TOKEN`. Bootstrap via `canvas-parent-mcp-qr-login`. - **Username/password (session-scrape)** — set `CANVAS_USERNAME` + `CANVAS_PASSWORD`. Direct Canvas accounts only (no SSO/2FA). Brittle. Precedence when multiple are set: `CANVAS_TOKEN` > username/password > OAuth > fetchproxy. Set `CANVAS_DISABLE_FETCHPROXY=1` to opt out of the fallback. ``` ### Technical Analysis The instructions allow users to place reusable Canvas credentials directly in an MCP configuration environment block. Depending on the MCP client and configuration location, these values may be stored as plaintext in a project-level `.mcp.json` or user configuration file. Project-local files may be committed to source control accidentally, while user-level files may be exposed through permissive filesy ...[truncated 2572 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer institution-approved OAuth with the narrowest available scopes and short-lived access tokens. 2. Store credentials in an operating-system credential manager or dedicated secret-management service rather than directly in `.mcp.json`. 3. Use secret references or runtime injection so configuration files contain identifiers rather than secret values. 4. Explicitly exclude project-level MCP configuration containing secrets from source control and provide a sanitized example file. 5. Restrict user-level configuration permissions to the owning account. 6. Avoid username-and-password authentication and session scraping where token-based authorization is available. 7. Do not expose multiple authentication modes simultaneously; provide the MCP process only the variables required for the selected mode. 8. Document the browser extension's required host and cookie permissions, trust boundary, storage behavior, and revocation procedure. 9. Provide instructions for terminating Canvas sessions, revoking OAuth grants, rotating tokens, and changing passwords after suspected exposure. 10. Run the MCP server with limited filesystem access and prevent unrelated child processes from inheriting Canvas secrets. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

MCP Config Access

High

• Category: Agent Snooping

Content

### Option A — npx (recommended)

Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The documentation normalizes reading browser cookies and alternate credentials without a strong warning that these are highly sensitive authentication artifacts granting access to student/parent educational records. In this context, weak disclosure is dangerous because users may enable powerful access paths without understanding that the MCP can impersonate their logged-in Canvas session outside the browser.

Credential Access

High

• Category: Privilege Escalation

Content

### Alternatives (env-var)

- **Personal access token** — set `CANVAS_TOKEN`. Most institutions have disabled this for non-admins.
- **OAuth** — set `CANVAS_CLIENT_ID`, `CANVAS_CLIENT_SECRET`, `CANVAS_REFRESH_TOKEN`. Bootstrap via `canvas-parent-mcp-qr-login`.
- **Username/password (session-scrape)** — set `CANVAS_USERNAME` + `CANVAS_PASSWORD`. Direct Canvas accounts only (no SSO/2FA). Brittle.

• Confidence: 90% confidence
• Finding: The skill supports multiple sensitive credential forms, including personal access tokens, OAuth client secrets and refresh tokens, and direct username/password entry. While documenting auth options is expected, encouraging storage of these secrets in MCP environment configuration materially increases credential exposure risk, especially in a skill handling FERPA-adjacent student/observer data.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger description says the skill should be used for phrases like "check Canvas" and also "any request about courses, assignments, grades, conversations, announcements, planner items, or files in Canvas." This scope is very broad and lacks exclusion conditions or negative examples, which increases the chance of unintended invocation for general educational queries.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documented fetchproxy mode reads active browser session cookies (`canvas_session` and `pseudonym_credentials`) from a signed-in Canvas tab and reuses them from Node. This is a sensitive credential-harvesting pattern because it bridges browser-authenticated state into another execution context, increasing the blast radius of session compromise and bypassing clearer consent boundaries typical of OAuth.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented primarily as a Canvas data-reading integration, but it also exposes `canvas_download_file(url, destinationPath)`, which can write downloaded content to an arbitrary local path. That expands the capability from read-only data access into local filesystem side effects, creating risk of overwriting files, planting sensitive course content on disk, or enabling unsafe follow-on use if an agent passes attacker-influenced paths.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Response shape (`view`)

Nine tools take `view: "compact" | "full"`, and **`compact` is the default** —
you get the slim shape without asking for it:

`canvas_get_profile`, `canvas_list_observees`, `canvas_get_course`,
`canvas_get_submission`, `canvas_list_recent_submissions`,

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.