Canvas LMS

Access Canvas LMS (Instructure) for course data, assignments, grades, and submissions. Use when checking due dates, viewing grades, listing courses, or fetching course materials from Canvas.

Security Scan

The skill's instructions correctly describe how to call the Canvas API, but the package metadata omits the sensitive environment variables the skill actually requires (CANVAS_TOKEN, CANVAS_URL), which is an incoherence you should understand before installing.

Purpose & Capability

Name/description match the runtime instructions: the SKILL.md gives legitimate Canvas REST API endpoints for courses, assignments, grades, and files. The actions described are coherent with the stated purpose.

Instruction Scope

The SKILL.md stays on-task: it only explains how to call Canvas API endpoints, how to include the Canvas token, how to handle pagination and responses, and how to parse results. It does not instruct the agent to read unrelated files or to transmit data to unknown endpoints.

Install Mechanism

Instruction-only skill with no install spec or codefiles. This has low installation risk because nothing is downloaded or written by an installer.

Credentials

The runtime instructions require a sensitive API token (CANVAS_TOKEN) and a Canvas instance URL (CANVAS_URL), but the registry metadata lists no required environment variables or primary credential. Requesting a bearer token is proportionate to the task, but the metadata omission is an inconsistency and a transparency problem. The SKILL.md also suggests storing the token in a .env file (which has persistence implications) without guidance about token scopes or least privilege.

Persistence & Privilege

always is false and the skill is user-invocable; nothing in the instructions requests elevated system privileges or modifications to other skills or system-wide configs. No persistent installers are present.

What to consider before installing

This skill appears to be a straightforward Canvas API helper, but the registry metadata does not declare the sensitive environment variables the SKILL.md asks you to set (CANVAS_TOKEN and CANVAS_URL). Before using or installing: 1) Verify the skill's source/owner (no homepage provided). 2) Create a Canvas API token with minimal scope (not an admin/global token) and use a revocable token you can delete later. 3) Prefer setting CANVAS_TOKEN only in a short-lived session environment rather than committing it to a shared ~/.env or repository. 4) Confirm CANVAS_URL points to your institution's official domain. 5) Ask the publisher to update the metadata to declare required env vars (so permission prompts are accurate). If you cannot verify the origin or cannot limit the token scope, do not install or provide your token.

Canvas LMS Skill

Access Canvas LMS data via the REST API.

Setup

1. Generate an API token in Canvas: Account → Settings → New Access Token
2. Store token in environment or .env file:

   export CANVAS_TOKEN="your_token_here"
   export CANVAS_URL="https://your-school.instructure.com"  # or canvas.yourschool.edu
   

Authentication

Include token in all requests:

curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/..."

Common Endpoints

Courses & Profile

# User profile
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/users/self/profile"

# Active courses
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses?enrollment_state=active&per_page=50"

# Dashboard cards (quick overview)
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/dashboard/dashboard_cards"

Assignments & Due Dates

# To-do items (upcoming work)
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/users/self/todo"

# Upcoming events
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/users/self/upcoming_events"

# Missing/overdue submissions
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/users/self/missing_submissions"

# Course assignments
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses/{course_id}/assignments?per_page=50"

# Assignment details
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses/{course_id}/assignments/{id}"

# Submission status
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses/{course_id}/assignments/{id}/submissions/self"

Grades

# Enrollments with scores
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/users/self/enrollments?include[]=current_grading_period_scores&per_page=50"

Extract grade: .grades.current_score

Course Content

# Announcements
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/announcements?context_codes[]=course_{course_id}&per_page=20"

# Modules
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses/{course_id}/modules?include[]=items&per_page=50"

# Files
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses/{course_id}/files?per_page=50"

# Discussion topics
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/courses/{course_id}/discussion_topics?per_page=50"

# Inbox
curl -s -H "Authorization: Bearer $CANVAS_TOKEN" "$CANVAS_URL/api/v1/conversations?per_page=20"

Response Handling

• List endpoints return arrays
• Pagination: check Link header for rel="next"
• Dates are ISO 8601 (UTC)
• Use --max-time 30 for slow endpoints

Parse with jq:

curl -s ... | jq '.[] | {name: .name, due: .due_at}'

Or Python if jq unavailable:

curl -s ... | python3 -c "import sys,json; data=json.load(sys.stdin); print(json.dumps(data, indent=2))"

Tips

• Course IDs appear in todo/assignment responses
• File download URLs are in the url field of file objects
• Always include per_page=50 to get more results (default is often 10)