Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/iblai/api/canvas-course-buildernpx skills add iblai/api --skill canvas-course-buildergit clone --depth 1 https://github.com/iblai/apiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/iblai/api/canvas-course-builder)<a href="https://agentmods.dev/skills/iblai/api/canvas-course-builder"><img src="https://agentmods.dev/badge/skills/iblai/api/canvas-course-builder.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00194 | $0.02679 |
| Opus 5 | $0.00097 | $0.01340 |
| Sonnet 5 | $0.00039 | $0.00536 |
| Haiku 4.5 | $0.00019 | $0.00268 |
Grade A, and why
canvas-course-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Building Canvas courses via the API
Canvas has no "create a whole course" endpoint. A course is assembled from a dozen independent resources, each with its own publish state, and the API will happily let you build something that looks complete in the admin view and is entirely invisible to students. Most of the difficulty in this task is ordering, publish state, and idempotency — not the individual HTTP calls.
Before touching the API
Three things to establish first, because getting them wrong is expensive:
-
Which instance and whose token. Read
CANVAS_API_URL(e.g.https://school.instructure.com) andCANVAS_API_TOKENfrom the environment. Never put a token in a file you write, in a command line that lands in shell history, or in anything you show back to the user. If they paste a token into the conversation, use it from an env var you set and mention that they should rotate it afterwards. -
Confirm identity and permissions before writing anything.
GET /api/v1/users/selftells you who the token belongs to;GET /api/v1/accountstells you which accounts they can create courses in (an empty list means teacher-level access — they can populate existing courses but not create new ones, which changes the whole plan). Do this even when the user seems certain, because a token scoped to the wrong sub-account fails halfway through a build and leaves debris. -
Is this production? Creating course content is not reversible in a satisfying way — deleted objects linger, notifications fire, students see things. Ask which course or sub-account to build in, and prefer a sandbox sub-account or a test course for the first run. If the user is clearly iterating on a script, suggest they point it at a throwaway course first.
The build order that works
Dependencies run one direction. Follow this and you never have to backfill an ID:
1. Course shell POST /accounts/:id/courses (leave unpublished)
2. Sections POST /courses/:id/sections
3. Assignment groups POST /courses/:id/assignment_groups (assignments need these)
4. Files 3-step upload (see references/recipes.md)
5. Pages POST /courses/:id/pages
Assignments POST /courses/:id/assignments
Discussions POST /courses/:id/discussion_topics
Quizzes + questions POST /courses/:id/quizzes then .../questions
6. Modules POST /courses/:id/modules
7. Module items POST /courses/:id/modules/:mid/items (needs IDs from step 5)
8. Front page / syllabus PUT /courses/:id/front_page, PUT /courses/:id
9. Enrollments POST /courses/:id/enrollments
10. Publish everything modules → then the course itself
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 196 lines · 194 tokens per session scan A d0c0d8752169
canvas-course-builder is a skill published in the GitHub repository iblai/api (15 stars, last pushed 5d ago), licensed MIT. It adds 194 tokens to every session and 2,679 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lesson
Produce or continue a deep-dive learning-track lesson (a focused mini-course on a hard subject the project needs), or review the user's track exercise work. Use when the user asks for the next lesson, help with a track exercise, or to start a new track.
docs-workflows
Documentation and extension workflows derived from local slash commands (docs, explanation, issues, prototypes, tutorials, MCP design review).
Accessibility Manual Audit
Teach agents to guide manual accessibility audits for keyboard, screen reader, zoom, reflow, focus, and WCAG 2.2 criteria that scanners miss.
recall
Recall this repository's OwnMem local memory before changing code, and keep it healthy. Use when a repository contains .ownmem/, when past debugging lessons could apply ("have we hit this before", "why is it done this way"), or when the user mentions ownmem, project memory, or recalling across sessions.
explainer
Create explainer videos with narration and AI-generated visuals. Triggers on: "解说视频", "explainer video", "explain this as a video", "tutorial video", "introduce X (video)", "解释一下XX(视频形式)".
vindicate
Use when the user wants to write, add, fix, stabilize (flaky), refactor, run, or audit Playwright browser tests, draft requirements/stories from a recording (no tests), find test-coverage gaps, scaffold a Playwright project, or set up Playwright CI. Vindicate's guided workflow for grounded, conformant Playwright test…