ClawHub
Back to skill

Security audit

Canvas Study Helper

Security checks for vulnerabilities and agentic risk

Overview

This Canvas study helper has a coherent course-checking purpose, but it handles Canvas session cookies in an unsafe way that warrants review before installation.

Review before installing or running. Do not place real Canvas cookies in ~/.canvas_cookie unless you trust and understand the scripts; safer versions should parse only expected cookie keys, require 0600 permissions, validate the Canvas hostname, and avoid following redirects with authenticated cookies. Rotate/revoke Canvas sessions if you suspect the cookie file was exposed or modified.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check_canvas.sh:29
Finding

Credential File Is Executed as Shell Code

Content
View full analysis
Remediation
View remediation
&2 exit 1 ;; esac done < "$CANVAS_COOKIE_FILE" if [ -z "$canvas_session" ] || [ -z "$log_session_id" ]; then echo "Required cookie fields are missing" >&2 exit 1 fi ``` Before parsing, validate the credential file: ```bash [ -f "$CANVAS_COOKIE_FILE" ] && [ ! -L "$CANVAS_COOKIE_FILE" ] || exit 1 [ "$(stat -c '%u' "$CANVAS_COOKIE_FILE")" -eq "$(id -u)" ] || exit 1 chmod 600 "$CANVAS_COOKIE_FILE" ``` Apply the same correction to `examples/check_canvas_example.sh`. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_canvas.sh:50
Finding

Authenticated Canvas Requests Follow Redirects Without Explicit Destination Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
/${CANVAS_DOMAIN}" &
        sleep 3
        echo "✅ 浏览器已启动，请在窗口中登录 SSO"
        ;;
    cookies)
        echo "🍪 提取 Cookie..."
        # 使用 CDP 获取 Cookie
        curl -s http://localhost:${CHROME_PORT}/json | jq -r '.[0].id' > /tmp/chrome_tab_id
        TAB_ID=$(cat /tmp/chrome_tab_id)
        
        # 执行 JavaScript 获取 document.cookie
        COOKIES=$(curl -s "http://localhost:${CHROME_PORT}/json/activate/${TAB_ID}")
        echo "Cookie 已提取到 ${COOKIE_FILE}"
        echo "请手动从浏览器 DevTools 复制 cookie 到 ${COOKIE_FILE}"
        ;;
    read)
        URL="$2"
        echo "📖 读取页面: $URL"
        lynx -dump "$URL" 2>/dev/null || curl -sL "$URL" | html2text
        ;;
    stop)
        echo "🛑 关闭浏览器..."
        pkill -f "chromium-browser.*remote-debugging-port=${CHROME_PORT}"
        rm -rf /tmp/chrome_dev_profile
        echo "✅ 浏览器已关闭"
        ;;
    *)
        echo "用�

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
stop)
        echo "🛑 关闭浏览器..."
        pkill -f "chromium-browser.*remote-debugging-port=${CHROME_PORT}"
        rm -rf /tmp/chrome_dev_profile
        echo "✅ 浏览器已关闭"
        ;;
    *)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
stop)
        echo "🛑 关闭浏览器..."
        pkill -f "chromium-browser.*remote-debugging-port=${CHROME_PORT}"
        rm -rf /tmp/chrome_dev_profile
        echo "✅ 浏览器已关闭"
        ;;
    *)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script uses source "$CANVAS_COOKIE_FILE" to load cookie values, which executes the file as shell code rather than parsing it as data. If an attacker can modify that file, they can run arbitrary commands with the user's privileges when the script starts, far exceeding the stated purpose of checking Canvas course information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The primary skill description is written as a Chinese-only statement, which imposes a specific language/locale in the user-facing documentation. The file does not offer an opt-in language choice or explain that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Within the embedded canvas_browser.sh, the cookies) case prints '提取 Cookie' and 'Cookie 已提取到' the cookie file, suggesting the command performs extraction. In reality it does not parse or persist any cookie values; it only hits /json and /json/activate/... and then asks the user to copy cookies manually, which directly contradicts the command's stated behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation states that the WSLg approach can use Chrome DevTools Protocol (CDP) automation, implying cookie extraction capability. However, the shown script's cookies branch only queries a tab ID and activates the tab, then tells the user to manually copy cookies instead of retrieving and writing them to ~/.canvas_cookie, so the documentation materially overstates what the code does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sources a local cookie file and exports session-related values for subsequent authenticated requests. While it prints status messages for course checks, it does not disclose that it is reading authentication material from disk, which is a sensitive operation for a code file under this rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script's comments, status messages, and generated note template are all in Chinese, which effectively fixes the skill's language/locale behavior. There is no indication that the user can choose another language or that the Chinese-only output is a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This shell script sources a cookie file containing Canvas session identifiers and then sends those credentials with multiple curl requests. While the code comments describe functionality, they do not clearly warn the user that authentication cookies are being read from disk and used for network access, which is a sensitive operation under the code-file warning criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script makes several curl calls to Canvas endpoints using authenticated cookies to fetch announcements, assignments, and files. Although network access is central to the script's purpose, there is no explicit user-facing notice that it will contact the remote Canvas service using the user's session and access course data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file's human-facing comments and console messages are written entirely in Chinese, with no indication that language selection is optional or tied to a justified region-specific use case. This can violate the stated language/locale policy when the skill does not offer user opt-in or explain the constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This shell script removes lecture_notes.md at the end, which is a file deletion operation. Although the PDF generation step is announced to the user, there is no comparable warning, comment for the user, or prompt indicating that the source markdown file will be deleted after execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language description is written entirely in Chinese, indicating a language-specific skill presentation without any visible opt-in, alternative locale, or justification that the skill is region-specific. This can violate language/locale policy where skills should not force a specific language absent user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Nearly all natural-language strings in the script, including instructions, errors, and status messages, are Chinese-only. The policy requires avoiding forced language constraints unless the skill offers choice or clearly documents a justified locale restriction, which this file does not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown template is written almost entirely in Chinese and includes a Chinese attribution label, which implicitly enforces a specific language for generated lecture notes. The file does not offer an alternative language option or state that the locale is user-selectable, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains natural-language content in multiple languages, including the Chinese phrase in the title. Under the language/locale policy rule, forcing or assuming a specific language without user opt-in can be a policy concern, and the template does not explain that it is intended for a Chinese-language audience or provide an alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.