中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
canvas-lms-student
Read-only Canvas LMS integration for student workflows — list courses, assignments, download files, export deadlines to calendar, search content
A straightforward, read-only Canvas LMS integration skill with clean code, accurate documentation, and no malicious behavior detected.
Skill Namecanvas-lms-student
Duration52.4s
Enginepi
✓
Safe to install
Approve for use. This skill performs exactly what it declares — read-only access to Canvas LMS course data — using the official canvasapi library with no hidden functionality.

Findings 2 items

Severity Finding Location
Low
Shell permission declared but not used Doc Mismatch
SKILL.md metadata declares 'anyBins: python3' and implies shell:WRITE capability, but no script executes shell commands, subprocess, or os.system calls. All functionality is pure Python I/O and HTTP.
anyBins:
        - python3
        - python
→ Remove anyBins from metadata if no binary execution is intended, or add shebang scripts if CLI wrapper is planned.
 SKILL.md:9
Info
Dependencies use caret upper bounds Supply Chain
requirements.txt specifies 'canvasapi>=3.0.0' and 'requests>=2.25.0' with no upper bound, which is standard for pip but means a major breaking version bump could silently change behavior.
canvasapi>=3.0.0
requests>=2.25.0
→ Consider pinning to a specific minor version (e.g., canvasapi>=3.0.0,<4.0.0) for reproducibility.
 requirements.txt:1
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned download_files.py writes to user-specified --output dir; get_assignment_detail.p…
Network READ READ ✓ Aligned All scripts use canvasapi/requests GET only; no POST, PUT, DELETE, or PATCH call…
Shell WRITE NONE ✓ Aligned No subprocess, os.system, or shell execution found in any script; only standard …
Environment READ READ ✓ Aligned canvas_client.py reads CANVAS_BASE_URL and CANVAS_API_TOKEN only; token used sol…
Skill Invoke NONE NONE — Scripts only call each other via Python import (list_courses.resolve_course_iden…
Clipboard NONE NONE — No clipboard access detected
Browser NONE NONE — No browser automation or WebFetch
Database NONE NONE — No database access
7 findings
🔗
Medium External URL 外部 URL
https://your-school.instructure.com
README.md:54
🔗
Medium External URL 外部 URL
https://canvas.university.edu
SKILL.md:44
🔗
Medium External URL 外部 URL
https://canvas.instructure.com/api/v1/
references/api-overview.md:10
🔗
Medium External URL 外部 URL
https://canvas.university.edu/api/v1/
references/api-overview.md:11
🔗
Medium External URL 外部 URL
https://canvas.instructure.com/api/v1/courses
references/api-overview.md:19
🔗
Medium External URL 外部 URL
https://calendar.google.com
scripts/export_calendar.py:160
📧
Info Email 邮箱地址
[email protected]
README.md:29

File Tree

16 files · 71.0 KB · 2248 lines
Python 7f · 1532L Markdown 8f · 714L Text 1f · 2L
├─ ▾ 📁 references
│ ├─ 📝 api-overview.md Markdown 67L · 1.3 KB
│ ├─ 📝 assignments.md Markdown 57L · 1.4 KB
│ ├─ 📝 calendar-export.md Markdown 66L · 1.6 KB
│ ├─ 📝 courses.md Markdown 51L · 1.1 KB
│ ├─ 📝 files.md Markdown 59L · 1.4 KB
│ └─ 📝 search.md Markdown 78L · 1.8 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 canvas_client.py Python 135L · 4.6 KB
│ ├─ 🐍 download_files.py Python 271L · 9.1 KB
│ ├─ 🐍 export_calendar.py Python 170L · 5.8 KB
│ ├─ 🐍 get_assignment_detail.py Python 237L · 7.6 KB
│ ├─ 🐍 get_assignments.py Python 242L · 8.7 KB
│ ├─ 🐍 list_courses.py Python 176L · 6.0 KB
│ └─ 🐍 search_canvas.py Python 301L · 10.5 KB
├─ 📝 README.md Markdown 100L · 2.1 KB
├─ 📄 requirements.txt Text 2L · 34 B
└─ 📝 SKILL.md Markdown 236L · 8.0 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
canvasapi >=3.0.0 pip No Official Canvas LMS Python SDK; no version cap
requests >=2.25.0 pip No Standard HTTP library; no version cap

Security Positives

✓ All scripts are read-only; no write, delete, or submit operations to Canvas API
✓ Uses official canvasapi library exclusively — no raw HTTP except for file downloads via requests with Bearer token
✓ No credential exfiltration: CANVAS_API_TOKEN is used only for Canvas API authentication
✓ No shell execution, subprocess, or os.system calls in any script
✓ No base64 encoding, obfuscation, or anti-analysis patterns
✓ File downloads go to user-specified output directory only
✓ SKILL.md accurately describes all tool behaviors and limitations
✓ No access to sensitive local paths (~/.ssh, ~/.aws, .env)
✓ No hidden instructions in comments or strings
✓ Clean error handling that doesn't suppress security-relevant exceptions
✓ No persistence mechanisms (no cron, startup scripts, or backdoors)