ClawHub
Back to skill

Security audit

Canvas LMS

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Canvas LMS API helper that reads Canvas data using the user's own Canvas URL and token.

Install only if you are comfortable letting the agent use your Canvas API token to read educational records such as grades, submissions, messages, course files, and assignments. Verify CANVAS_URL is your institution's real Canvas domain, keep the token out of shared logs and committed .env files, avoid unnecessary sensitive queries, and revoke the token when it is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to place a long-lived Canvas API token in environment variables and demonstrates broad access to profile, grades, inbox, submissions, and course data without any privacy, least-privilege, or secret-handling guidance. This creates a real risk of credential exposure or over-collection of FERPA-sensitive student information if the token is mishandled, logged, or used in shared environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.