Canvas LMS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:06 AM UTC
• Version: 1.0.0

Overview

This Canvas skill is coherent and not malicious, but it needs review because it uses a Canvas token to access sensitive grades, files, and inbox data without enough privacy or credential safeguards.

Review before installing. Use this only with a Canvas domain you trust, prefer a protected secret store over a plaintext .env file, keep the token least-privilege and revocable, and have the agent fetch only the specific Canvas records needed for the task.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

Canvas bearer token may be transmitted to an untrusted configurable endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-20
Vulnerability Type: Unvalidated credential destination and insufficient transport enforcement
Risk Level: Medium

Vulnerable Code

bash

export CANVAS_TOKEN="your_token_here"
export CANVAS_URL="https://your-school.instructure.com"  # or canvas.yourschool.edu

bash

curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/..."

Technical Analysis

The Skill instructs the agent to obtain the request destination from the environment-controlled CANVAS_URL variable and send CANVAS_TOKEN in an HTTP authorization header. It does not require HTTPS at execution time, validate the destination hostname against a trusted Canvas instance, or request confirmation before sending the credential.

Although the documented example uses HTTPS, a modified, poisoned, or mistakenly configured CANVAS_URL can identify an attacker-controlled server or an unencrypted HTTP endpoint. Following the documented command would then disclose the bearer token to that endpoint. The exposed token could subsequently be reused according to the permissions granted by Canvas.

Network access and Canvas authentication are necessary for the declared functionality. However, transmitting a sensitive bearer token without validating the configured destination exceeds safe minimum credential-handling requirements.

The separate curl ... | python3 -c ... response-processing example is not remote payload execution: it parses downloaded content as JSON using fixed local Python code and does not evaluate the response as Python or shell source.

Attack Path

1. An attacker, compromised setup process, or erroneous configuration changes CANVAS_URL to an attacker-controlled hostname or an HTTP endpoint.
2. The user or agent executes a documented Canvas API request without validating the configured scheme and hostname.
3. curl sends the `Authorization: Beare ...[truncated 927 chars]

Remediation

View remediation

Remediation Suggestions

1. Require an HTTPS URL and reject every other scheme before transmitting the token.

2. Parse and validate CANVAS_URL rather than concatenating an arbitrary environment value into authenticated requests.

3. Require the hostname to match a user-approved Canvas domain or an explicit allowlist.

4. Reject URLs containing embedded credentials, unexpected paths, query strings, fragments, or nonstandard ports unless explicitly required.

5. Use hardened curl options such as:

   bash

   curl --fail-with-body --show-error --silent \
     --proto '=https' \
     --max-redirs 0 \
     --connect-timeout 10 \
     --max-time 30 \
     -H "Authorization: Bearer $CANVAS_TOKEN" \
     "$VALIDATED_CANVAS_URL/api/v1/..."
   

6. If redirects are later enabled, ensure authentication headers cannot be forwarded to a different origin and validate every redirect destination.

7. Prompt the user to confirm the normalized destination hostname before the first authenticated request.

8. Recommend a least-privilege, revocable Canvas token and document immediate revocation and replacement procedures for suspected exposure.

9. Store the token in a protected secret manager or tightly permissioned environment configuration. Avoid committing it to the project or placing it in an unprotected .env file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

Setup

1. Generate an API token in Canvas: Account → Settings → New Access Token
2. Store token in environment or .env file:

   bash

   export CANVAS_TOKEN="your_token_here"
   

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Or Python if jq unavailable:

bash

curl -s ... | python3 -c "import sys,json; data=json.load(sys.stdin); print(json.dumps(data, indent=2))"

Tips

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is designed to retrieve grades, submissions, inbox messages, files, and profile/course data, all of which may contain FERPA-protected or otherwise sensitive student information, yet it provides no privacy warning or consent guidance. In an agent setting, this omission increases the chance of over-collection, accidental disclosure, or user requests being fulfilled without clear awareness of the data sensitivity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to create and store a long-lived Canvas API token in the environment or a .env file, but gives no warning that this credential grants access to sensitive educational records and messages. In agent or shared-shell contexts, environment variables and local secret files are commonly exposed through logs, process inspection, repository commits, or prompt leakage, making this a real secret-handling weakness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.