canvas-course-builder

canvas-course-builder is a skill for Claude Code, Codex from iblai/api. It costs 194 tokens per session (2,679 once invoked), scanned A, original, MIT.

A tool for building and filling Canvas LMS courses through its web API. Canvas is a system schools use to manage online courses, lessons, assignments and students.

In plain words
What is it for?
Use it to create course structures, lessons, assignments, quizzes and discussions, upload files, manage sections and enrollments, or seed and copy courses from a specification.
Why use it?
Creating a complete course requires many separate resources, publishing settings and careful ordering, so manual API work is easy to get wrong.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/iblai/api/canvas-course-builder
Any agent
npx skills add iblai/api --skill canvas-course-builder
Clone the repo
git clone --depth 1 https://github.com/iblai/api

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for canvas-course-builder

README.md
[![agentmods](https://agentmods.dev/badge/skills/iblai/api/canvas-course-builder.svg)](https://agentmods.dev/skills/iblai/api/canvas-course-builder)
Your own site
<a href="https://agentmods.dev/skills/iblai/api/canvas-course-builder"><img src="https://agentmods.dev/badge/skills/iblai/api/canvas-course-builder.svg" alt="Measured on agentmods" height="20"></a>
Per session 194 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,679 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00194 $0.02679
Opus 5 $0.00097 $0.01340
Sonnet 5 $0.00039 $0.00536
Haiku 4.5 $0.00019 $0.00268

Measured 3d ago against content hash d0c0d8752169, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

canvas-course-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/build_course.py, scripts/canvas_client.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/canvas-course-builder/SKILL.md · 196 lines

How it starts

The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Building Canvas courses via the API

Canvas has no "create a whole course" endpoint. A course is assembled from a dozen independent resources, each with its own publish state, and the API will happily let you build something that looks complete in the admin view and is entirely invisible to students. Most of the difficulty in this task is ordering, publish state, and idempotency — not the individual HTTP calls.

Before touching the API

Three things to establish first, because getting them wrong is expensive:

  1. Which instance and whose token. Read CANVAS_API_URL (e.g. https://school.instructure.com) and CANVAS_API_TOKEN from the environment. Never put a token in a file you write, in a command line that lands in shell history, or in anything you show back to the user. If they paste a token into the conversation, use it from an env var you set and mention that they should rotate it afterwards.

  2. Confirm identity and permissions before writing anything. GET /api/v1/users/self tells you who the token belongs to; GET /api/v1/accounts tells you which accounts they can create courses in (an empty list means teacher-level access — they can populate existing courses but not create new ones, which changes the whole plan). Do this even when the user seems certain, because a token scoped to the wrong sub-account fails halfway through a build and leaves debris.

  3. Is this production? Creating course content is not reversible in a satisfying way — deleted objects linger, notifications fire, students see things. Ask which course or sub-account to build in, and prefer a sandbox sub-account or a test course for the first run. If the user is clearly iterating on a script, suggest they point it at a throwaway course first.

The build order that works

Dependencies run one direction. Follow this and you never have to backfill an ID:

1. Course shell            POST /accounts/:id/courses            (leave unpublished)
2. Sections                POST /courses/:id/sections
3. Assignment groups       POST /courses/:id/assignment_groups   (assignments need these)
4. Files                   3-step upload (see references/recipes.md)
5. Pages                   POST /courses/:id/pages
   Assignments             POST /courses/:id/assignments
   Discussions             POST /courses/:id/discussion_topics
   Quizzes + questions     POST /courses/:id/quizzes then .../questions
6. Modules                 POST /courses/:id/modules
7. Module items            POST /courses/:id/modules/:mid/items  (needs IDs from step 5)
8. Front page / syllabus   PUT  /courses/:id/front_page, PUT /courses/:id
9. Enrollments             POST /courses/:id/enrollments
10. Publish everything     modules → then the course itself

Read the full file on GitHub · 196 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 196 lines · 194 tokens per session scan A d0c0d8752169

Subscribe to this mod's changes

canvas-course-builder is a skill published in the GitHub repository iblai/api (15 stars, last pushed 5d ago), licensed MIT. It adds 194 tokens to every session and 2,679 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

lesson

Produce or continue a deep-dive learning-track lesson (a focused mini-course on a hard subject the project needs), or review the user's track exercise work. Use when the user asks for the next lesson, help with a track exercise, or to start a new track.

ahamedzoha/atelier · 56 tokens

docs-workflows

Documentation and extension workflows derived from local slash commands (docs, explanation, issues, prototypes, tutorials, MCP design review).

TencentCloudBase/CloudBase-AI-Toolkit · 28 tokens

Accessibility Manual Audit

Teach agents to guide manual accessibility audits for keyboard, screen reader, zoom, reflow, focus, and WCAG 2.2 criteria that scanners miss.

PramodDutta/qaskills · 36 tokens

recall

Recall this repository's OwnMem local memory before changing code, and keep it healthy. Use when a repository contains .ownmem/, when past debugging lessons could apply ("have we hit this before", "why is it done this way"), or when the user mentions ownmem, project memory, or recalling across sessions.

grpcer/ownmem · 66 tokens

explainer

Create explainer videos with narration and AI-generated visuals. Triggers on: "解说视频", "explainer video", "explain this as a video", "tutorial video", "introduce X (video)", "解释一下XX(视频形式)".

marswaveai/skills · 56 tokens

vindicate

Use when the user wants to write, add, fix, stabilize (flaky), refactor, run, or audit Playwright browser tests, draft requirements/stories from a recording (no tests), find test-coverage gaps, scaffold a Playwright project, or set up Playwright CI. Vindicate's guided workflow for grounded, conformant Playwright test…

OpenEvident/vindicate · 77 tokens