Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/majiayu000/claude-skill-registrynpx agentmods add skills/majiayu000/claude-skill-registry/agent-canvas-setupWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/majiayu000/claude-skill-registry/agent-canvas-setup)<a href="https://agentmods.dev/skills/majiayu000/claude-skill-registry/agent-canvas-setup"><img src="https://agentmods.dev/badge/skills/majiayu000/claude-skill-registry/agent-canvas-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/majiayu000/claude-skill-registry/agent-canvas-setup"><img src="https://agentmods.dev/badge/skills/majiayu000/claude-skill-registry/agent-canvas-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 3 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.01135 |
| Opus 5 | $0.00039 | $0.00567 |
| Sonnet 5 | $0.00016 | $0.00227 |
| Haiku 4.5 | $0.00008 | $0.00113 |
Grade A, and why
agent-canvas-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Canvas Setup
Checks and installs dependencies for the agent-canvas visual editing skills (agent-eyes, agent-canvas, canvas-edit).
Quick Check
Run this first to see what's needed:
uv run .claude/skills/agent-canvas-setup/scripts/check_setup.py check
If all checks pass → Ready to use canvas skills.
If checks fail → Ask user about installation scope.
Installation Scopes
ALWAYS ask the user which scope they prefer before installing:
| Scope | What it does | Best for |
|---|---|---|
temporary |
Browsers installed globally, Python deps cached by uv on-demand (~/.cache/uv) | Most users - minimal footprint |
local |
Creates .venv in project with playwright installed |
Projects wanting isolated deps |
global |
Installs browsers globally only (Python deps via uv) | Shared workstations |
Recommended Prompt to User
Agent Canvas needs some dependencies. How would you like to install them?
1. **temporary** (recommended) - Minimal footprint. Browsers installed to system cache,
Python packages managed on-demand by uv. Nothing added to your project.
2. **local** - Creates a .venv in this project with playwright. Good if you want
all dependencies tracked with the project.
3. **global** - Same as temporary. Browsers go to system cache.
Which do you prefer? (1/2/3 or temporary/local/global)
Multi-Agent Support
Agent Canvas can install skills for multiple AI agents. Use --agents to specify which agents:
| Agent | Skills Directory | Description |
|---|---|---|
claude |
.claude/skills/ |
Claude Code / Claude Desktop (default) |
codex |
.codex/skills/ |
OpenAI Codex CLI |
copilot |
.github/skills/ |
GitHub Copilot |
cursor |
.cursor/skills/ |
Cursor IDE |
windsurf |
.windsurf/skills/ |
Windsurf IDE |
aider |
.aider/skills/ |
Aider |
Examples
# Install for Claude only (default)
uv run .claude/skills/agent-canvas-setup/scripts/check_setup.py install --scope temporary
# Install for Claude and Copilot
uv run .claude/skills/agent-canvas-setup/scripts/check_setup.py install --scope temporary --agents claude,copilot
# Install for all supported agents
uv run .claude/skills/agent-canvas-setup/scripts/check_setup.py install --scope temporary --agents claude,copilot,cursor,windsurf,aider
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 132 lines · 79 tokens per session scan A 1c141a9a09c8
agent-canvas-setup is a skill published in the GitHub repository majiayu000/claude-skill-registry (600 stars, last pushed yesterday), licensed MIT. It adds 79 tokens to every session and 1,135 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
eval-graphics
Turn an eval study's numbers into on-brand, publish-ready figures using the Newsjack chart room (the eval design system), then validate them with Playwright. For producing the charts in a published eval/data study.
software-in-worten
Übersetzt zwischen Benutzeroberfläche und Text — in beide Richtungen. Aus einer beschriebenen Oberfläche wird ein Skill; aus einem Skill wird eine Oberfläche. Nutzen, wenn eine Anwendung entworfen wird und der Ablauf noch unklar ist, wenn ein bestehendes Werkzeug als Skill verfügbar gemacht werden soll, wenn…
ui-ux-auditor
A UI and UX review skill that examines a project’s visual design and interactions, using screenshots, a public site, or the source code as evidence. UI means the visible interface; UX means how people use it.
pivoshenko-brand
Central brand system for Volodymyr Pivoshenko — voice, type, color, layout, iconography. Self-contained; covers any output format (web UI, PDF, slide deck, README, social card, email, terminal/theme port, throwaway mock). Trigger even when the user doesn't say "brand" — any visual or copy decision touching pivoshenko…
mermaid-generator
A manually triggered guide for creating Mermaid diagrams, which are text descriptions that render as flowcharts and other diagrams. It chooses a diagram type and generates compatible, professionally styled Mermaid code.
excalidraw-visual-designer
Create and revise editable visual drawings directly in the Excalidraw website through the in-app browser. Use when the user asks Codex to draw in Excalidraw or update an Excalidraw canvas, including diagrams, flowcharts, architecture sketches, process maps, infographics, teaching visuals, product explanation graphics…