skills/likr/canvas-lms-agent/canvas-lms/Socket

canvas-lms

Warn

Audited by Socket on Jul 9, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's stated Canvas LMS purpose is coherent and the requested Canvas credentials are proportionate, but the main risk is trust in the unseen local `canvas-lms-mcp` process that receives a live API token. No direct malicious behavior is shown, yet the core executable and credential path are insufficiently verifiable from the skill alone.

Confidence: 82%Severity: 80%

Audit Metadata

Analyzed At

Jul 9, 2026, 04:27 PM

Package URL

pkg:socket/skills-sh/likr%2Fcanvas-lms-agent%2Fcanvas-lms%2F@681d248377a85e21ea088b530992bfdedf673ac13b6f02b0837cf3fb73485112