Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Canvas LMS Student Skill

v0.1.1

Use when the user needs to interact with Canvas LMS as a student. Trigger phrases include "check my homework", "what's due", "download my lecture PDFs", "lis...

0· 94·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for efan404/canvas-lms-student.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Canvas LMS Student Skill" (efan404/canvas-lms-student) from ClawHub.
Skill page: https://clawhub.ai/efan404/canvas-lms-student
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: CANVAS_BASE_URL, CANVAS_API_TOKEN
Config paths to check: ~/.config/canvas-lms/config.json
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install canvas-lms-student

ClawHub CLI

Package manager switcher

npx clawhub@latest install canvas-lms-student
Security Scan
Capability signals
Requires OAuth token
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
stale
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match requested artifacts: CANVAS_BASE_URL, CANVAS_API_TOKEN, a config file path, and Python. All required env vars and the config file are coherent with a Canvas student read-only client.
Instruction Scope
SKILL.md and the scripts instruct the agent to call Canvas APIs, list courses/assignments, download files, and export calendars. The runtime instructions reference only the declared env vars and the declared config path. File downloads and writing .ics or saved outputs are expected behavior for this skill.
Install Mechanism
Registry metadata states 'No install spec — instruction-only', but the bundle contains Python scripts, a manifest with a setup_script/entry_point, a setup.sh, requirements.txt, and an entry wrapper.py. This mismatch means the registry may not auto-install dependencies or run setup.sh; conversely, some installers might run setup.sh. You should inspect setup.sh and wrapper.py before executing any install or setup steps. The code is bundled locally (no external downloads found), which lowers network-install risk, but local install scripts still can run arbitrary commands.
Credentials
Only two environment items are required: CANVAS_BASE_URL and CANVAS_API_TOKEN (primary credential) plus an optional config file path in the user's home directory. These are appropriate for the described Canvas operations and there are no unrelated credentials or broad permissions requested.
Persistence & Privilege
The skill does not request always:true or other elevated registry privileges. It reads/writes only its own config path (~/.config/canvas-lms/config.json) and writes downloaded files/exports to locations the user specifies; it does not modify other skills or global agent settings.
What to consider before installing
This bundle mostly looks coherent for a Canvas read-only tool, but take these precautions before installing or running it: 1) Inspect setup.sh and wrapper.py (and any other scripts) to confirm they only install Python packages and don't run unexpected shell commands. 2) Verify the package's source (the GitHub homepage) and check maintainer reputation and recent commits. 3) Limit exposure of your Canvas API token: prefer using a short-lived token or revoke it if you suspect misuse; consider using environment variables rather than storing the token in ~/.config unless you trust the machine. 4) Be aware the scripts will write files to disk (downloads and .ics exports); choose safe output paths and don't run as a privileged user. 5) Because registry metadata said 'instruction-only' but code and a setup script are present, assume the installer will not automatically install dependencies — run pip install -r requirements.txt in a controlled environment (e.g., virtualenv) after review. If you want higher assurance, request the author to clarify/install steps or review the full setup.sh/wrapper.py for any hidden commands. If you prefer not to trust the bundle, perform actions manually using the official canvasapi SDK and your token instead.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎓 Clawdis
Any binpython3, python
EnvCANVAS_BASE_URL, CANVAS_API_TOKEN
Config~/.config/canvas-lms/config.json
Primary envCANVAS_API_TOKEN
canvasvk9707n7g78tey1rdm6zvc85ta1847wr0educationvk9707n7g78tey1rdm6zvc85ta1847wr0latestvk9707n7g78tey1rdm6zvc85ta1847wr0lmsvk9707n7g78tey1rdm6zvc85ta1847wr0
94downloads
0stars
2versions
Updated 3w ago
v0.1.1
MIT-0

Canvas LMS Student Skill

This skill enables read-only access to Canvas LMS for student workflows.

When to Use

Invoke this skill when the user asks anything related to their Canvas courses, such as:

  • "Check my homework" / "what's due this week"
  • "List my Canvas courses" / "what classes am I taking"
  • "Download my lecture PDFs" / "get course materials"
  • "When is my assignment due" / "upcoming deadlines"
  • "Show my grades" / "how am I doing in CS101"
  • "Find the syllabus" / "search for project requirements"
  • "Export deadlines to my calendar"
  • "Help me write my essay" (will gather assignment requirements)

Key indicators: Canvas, course, assignment, homework, deadline, grade, syllabus, lecture notes, materials.

Prerequisites

Configuration (in order of precedence):

  1. Environment Variables (highest priority):

    • CANVAS_BASE_URL - Institution Canvas URL (e.g., https://canvas.university.edu)
    • CANVAS_API_TOKEN - Personal API token from Canvas Settings
  2. Config File (fallback if env vars not set):

    • Location: ~/.config/canvas-lms/config.json
    • Format: {"base_url": "...", "api_token": "..."}
    • Created automatically if you use the CLI tool (canvas-lms config)

Setup Guide (if not configured):

  1. Guide user to: Canvas → Account → Settings → Approved Integrations
  2. Click "+ New Access Token"
  3. Configure using ONE of these methods:
    • Environment variables:
      export CANVAS_BASE_URL="https://your-school.instructure.com"
      export CANVAS_API_TOKEN="copied-token"
      
    • CLI tool (easier for humans):
      pip install canvas-lms-cli
      canvas-lms config  # Interactive setup
      
  4. Test with: python scripts/canvas_client.py --test

Available Tools

1. List Courses

Script: python scripts/list_courses.py

Purpose: Get course IDs and basic information for other operations.

Key Options:

  • --active-only - Show only current enrollments
  • --with-grades - Include current scores
  • --json - Output structured JSON (recommended for AI parsing)
  • --resolve "Course Name" - Find course by name instead of ID

Output: Course ID, name, code, grade (optional)

When to Use:

  • First step before any course-specific operation to get valid course IDs
  • Or use --resolve to find course ID from name (e.g., --resolve "CS101")

AI Tip: Use --json for reliable parsing, or --resolve to convert course names to IDs automatically.


2. Get Assignments

Script: python scripts/get_assignments.py --course <ID>

Purpose: List assignments with deadlines and submission status.

Key Options:

  • --course 12345 or --course "CS101" --resolve-name - Course ID or name
  • --upcoming - Only future assignments
  • --overdue - Only overdue assignments
  • --unsubmitted - Only pending work
  • --with-description - Include full descriptions
  • --json - Output structured JSON
  • --assignment-name "Project" - Find specific assignment by name

When to Use: Checking workload, finding deadlines, or getting assignment overview.

AI Tip: Use --resolve-name to avoid manual ID lookup, or --assignment-name to find specific assignments by name.


3. Get Assignment Detail (For AI Writing)

Script: python scripts/get_assignment_detail.py --course <ID> --assignment <ID>

Purpose: Retrieve complete assignment requirements for AI-assisted writing.

Returns:

  • Full description/prompt (cleaned HTML)
  • Points possible and rubric criteria
  • Submission type requirements
  • Due date and submission status
  • Allowed file extensions

When to Use: Before AI-assisted essay/assignment writing to get full context and requirements.


4. Download Course Files

Script: python scripts/download_files.py --course <ID> --output <DIR>

Purpose: Download all course materials to local directory.

Key Options:

  • --folder "Folder Name" - Download specific folder only
  • --type pdf - Filter by file extension
  • --dry-run - Preview without downloading
  • --flat - Flat structure (don't preserve Canvas folders)
  • --json - Output file list as JSON
  • --no-id-prefix - Don't add ID prefix to duplicate filenames

When to Use: Gathering reading materials, saving lecture notes, or collecting reference documents.

File Organization: By default, preserves Canvas folder structure. Files with duplicate names get ID prefix (e.g., 12345_lecture.pdf). Use --flat for flat structure.


5. Export Deadlines to Calendar

Script: python scripts/export_calendar.py --course <IDs> --output <FILE>

Purpose: Export assignment deadlines to iCalendar (.ics) format.

Key Options:

  • --courses 123,456,789 - Multiple courses (comma-separated)
  • --unsubmitted-only - Only pending assignments

When to Use: Creating calendar reminders, syncing with Google/Apple Calendar.


6. Search Canvas Content

Script: python scripts/search_canvas.py --query "<search>"

Purpose: Find files, assignments, or announcements across courses.

Key Options:

  • --course <ID> - Search specific course only
  • --type assignment|file|announcement - Limit search type
  • --full-content - Show content previews

When to Use: Finding specific resources, locating assignment requirements, checking announcements.


Workflow Patterns

Pattern 1: AI-Assisted Essay Writing

1. List courses → get course ID
2. Get assignments → find target assignment ID
3. Get assignment detail → retrieve full requirements and rubric
4. (Optional) Search for related materials
5. (Optional) Download reference files
6. AI generates essay based on gathered context

Pattern 2: Deadline Management

1. List courses → get all course IDs
2. Export calendar → generate .ics with all deadlines
3. Import to calendar app for reminders

Pattern 3: Course Material Collection

1. List courses → get course ID
2. Download files → get all course materials
3. Search for specific topics if needed

Safety & Limitations

Read-Only: This skill only reads data. It cannot:

  • Submit assignments
  • Modify grades
  • Post to discussions
  • Upload files to Canvas

Rate Limits: Canvas API has rate limiting. For bulk operations:

  • Use pagination (handled automatically)
  • Add delays between requests if needed
  • Handle 429 errors with exponential backoff

Data Privacy:

  • API tokens are password-equivalent
  • Never log or expose tokens
  • All data stays local (downloads only)

Error Handling

Common errors and solutions:

ErrorCauseSolution
401 UnauthorizedInvalid/expired tokenGuide user to regenerate token
403 ForbiddenInsufficient permissionsCheck enrollment status
404 Not FoundWrong course/assignment IDVerify IDs from list commands
429 Rate LimitedToo many requestsAdd delay and retry

References


OpenClaw Integration

This repository can be installed from ClawHub/OpenClaw as a skill bundle. OpenClaw discovers the skill from SKILL.md. The added manifest.json and wrapper.py are supplemental helper files for wrapper-based environments; they do not auto-register seven native OpenClaw tools by themselves. If you want native tool exposure inside OpenClaw, package the wrapper as a plugin or MCP server separately.

Installation

# Preferred: install from ClawHub/OpenClaw
openclaw skills install canvas-lms-student

# Or install with clawhub
clawhub install canvas-lms-student

# Or clone the repository directly
git clone https://github.com/Efan404/canvas-lms-student-skill.git

# Run setup to install dependencies
cd canvas-lms-student-skill
./setup.sh

# Or manually install dependencies
pip3 install canvasapi requests

Configuration

Set up Canvas API access:

# Method 1: Environment variables
export CANVAS_BASE_URL="https://your-school.instructure.com"
export CANVAS_API_TOKEN="your-api-token"

# Method 2: Config file
mkdir -p ~/.config/canvas-lms
echo '{"base_url": "https://...", "api_token": "..."}' > ~/.config/canvas-lms/config.json

Get API token: Canvas → Account → Settings → Approved Integrations → + New Access Token

Available Tools

When used through the local wrapper, these commands are available:

ToolDescriptionExample
list_coursesList all courseslist_courses()
resolve_courseFind course by nameresolve_course(name="CS5293")
get_assignmentsGet course assignmentsget_assignments(course="CS5293")
get_assignment_detailGet assignment infoget_assignment_detail(course=67488, assignment=319756)
search_canvasSearch contentsearch_canvas(query="project", type="assignment")
download_filesDownload course filesdownload_files(course=67488, type="pdf")
export_calendarExport deadlinesexport_calendar(courses="67488,67524")

Wrapper Usage

For programmatic access, use the wrapper:

python3 wrapper.py list_courses '{"active_only": true}'
python3 wrapper.py get_assignments '{"course": "CS5293", "upcoming": true}'
python3 wrapper.py search_canvas '{"query": "deadline", "type": "announcement"}'

Manifest

See manifest.json for complete tool definitions and parameter schemas.

Comments

Loading comments...