plugin-api-server-security

Audit Canvas plugin API endpoints for authentication and authorization.

2|1|Updated Nov 27, 2025

Search Tags:#authorization #security #authentication #review #websocket #canvas-sdk #simpleapi

Ready to run

npx skills add https://github.com/canvas-medical/coding-agents --skill plugin-api-server-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: plugin-api-server-security
Source: https://github.com/canvas-medical/coding-agents/tree/main/canvas-plugin-assistant/skills/plugin-api-server-security
Command: npx skills add https://github.com/canvas-medical/coding-agents --skill plugin-api-server-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The Skill provides a structured approach to security reviewing Canvas plugins that expose API endpoints. It helps ensure authentication and authorization are correctly implemented for SimpleAPI and WebSocket handlers when the plugin acts as the SERVER.

Core Features & Use Cases

Best practices for using built-in authentication mixins (StaffSessionMixin, PatientSessionMixin, APIKeyAuthMixin) to reduce boilerplate and improve auditability.
Security review patterns and common vulnerabilities, including how to validate credentials, scope access, and protect patient data in API endpoints.
A practical security checklist and reporting workflow to communicate findings and ensure remediation before deployment.

Quick Start

Review your plugin's API handlers and apply the security patterns described here: check for mixin usage, verify authentication paths, and annotate endpoints with appropriate access controls.

Frequently Asked Questions about plugin-api-server-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Canvas plugin API endpoints for proper authentication and authorization?▼

Audit Canvas plugin API endpoints by validating mixin usage, access controls, and secret management for SimpleAPI and WebSocket handlers. Apply built-in authentication mixins and document findings via a security checklist to ensure proper authentication and authorization.

What is the best way to secure WebSocket handlers in a Canvas server-side plugin?▼

Secure WebSocket handlers by applying built-in authentication mixins such as APIKeyAuthMixin to validate credentials and scope access. Review patterns to protect patient data and ensure proper authorization controls are enforced during development and deployment.

How does APIKeyAuthMixin work for Canvas plugin SimpleAPI authentication?▼

APIKeyAuthMixin works by providing a built-in authentication pattern for SimpleAPI handlers to validate API credentials and reduce boilerplate. It improves auditability by enforcing recommended access controls and scoping access to protect patient data.

Do I need to use StaffSessionMixin and PatientSessionMixin to review Canvas plugin security?▼

Using StaffSessionMixin and PatientSessionMixin is recommended to reduce boilerplate and improve auditability when reviewing Canvas plugin security. These built-in authentication mixins validate credentials, scope access, and ensure proper authorization for API endpoints.

What common authorization vulnerabilities should I check for during a Canvas plugin security review?▼

Check for missing or incorrect mixin usage, unvalidated credentials, improperly scoped access controls, and unmanaged secrets during a Canvas plugin security review. Document these common vulnerabilities using a practical security checklist to ensure remediation before deployment.