Security audit

Tmp.M0RUFwrrip

Security checks across malware telemetry and agentic risk

Overview

This Canvas skill mostly matches its stated purpose, but it uses sensitive Canvas session credentials and its file-download runtime can send those credentials to an arbitrary URL if misused.

Install only if you are comfortable granting the MCP access to your Canvas account or linked student records. Prefer a scoped token or OAuth where available, use fetchproxy only intentionally, confirm every file download path, and avoid allowing arbitrary URLs to be passed to canvas_download_file until the package validates that downloads stay on the configured Canvas host.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The manifest and description present the skill as answering questions about Canvas data, but the documented toolset also includes writing files to local disk via `canvas_download_file(url, destinationPath)`. This is a capability expansion beyond the stated purpose, which can surprise users and increases the risk of unintended local file writes if the agent invokes the tool without clear consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill can authenticate by reading active browser session cookies through the fetchproxy extension, but this sensitive behavior is not reflected in the high-level purpose statement. Accessing live session cookies materially changes the trust model because the tool can inherit authenticated access without the user explicitly supplying credentials for this session.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The trigger description is extremely broad, covering many common course-related phrases and effectively any request about assignments, grades, announcements, files, or Canvas LMS. Over-broad activation increases the chance the skill is invoked unexpectedly, which is more dangerous here because the skill has access to sensitive educational data and file-download capability.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The documentation states that the MCP reads `canvas_session` and `pseudonym_credentials` cookies from a signed-in browser tab, but it does not present this as a prominent warning commensurate with the sensitivity of session-cookie access. Users may treat the setup as zero-config convenience without appreciating that the skill can inherit authenticated access to private student and parent data from their browser state.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The tool `canvas_download_file(url, destinationPath)` writes downloaded Canvas files to a caller-specified local path, but the documentation does not prominently warn about the local disk write effect. This can lead to unexpected persistence of sensitive school documents or misuse of arbitrary destination paths if an agent is prompted to save files automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.