SJTU Canvas 课程助手

SJTU Canvas LMS 课程助手。管理上海交通大学 Canvas (oc.sjtu.edu.cn) 课程数据。 也适用于其他基于 Canvas LMS 的高校，修改 base_url 即可。 触发场景: (1) 查看/下载课程文件(PPT/PDF)、批量下载课件 (2) 查看作业列表、DDL、提交状态、提...

Security Scan

The skill is internally consistent with its stated Canvas LMS purpose: it asks for a Canvas API token in a config file, calls the Canvas API, extracts files locally, and (optionally) syncs DDLs to Apple Calendar — nothing appears to exfiltrate data to unexpected endpoints or require unrelated credentials.

Purpose & Capability

Name/description describe Canvas LMS operations and the code + SKILL.md only request a Canvas API token and local paths. The code interacts with Canvas endpoints, downloads course files, extracts text, and syncs to Apple Calendar — all match the stated features.

Instruction Scope

Runtime instructions and scripts operate on expected artifacts: config.json (contains canvas_token and base_url), course files, and local file paths. The calendar sync uses osascript to create Calendar events on macOS. The SKILL.md explicitly instructs the user to provide the token and to confirm before submitting assignments. Note: scripts will read and write local files and may access any file paths you pass them (normal for this kind of tool).

Install Mechanism

No automated install spec; this is instruction-only plus included Python scripts. Dependencies are installed via pip per the README/SKILL.md. No downloads from untrusted URLs or archive extraction are present.

Credentials

No environment variables are requested; instead the skill expects a config.json containing a Canvas API token and base_url — this is appropriate for Canvas integration. The token is powerful (access to your Canvas data) so protecting it is necessary. The skill does not request unrelated credentials.

Persistence & Privilege

The skill is not forced-always and does not ask to modify other skills or global agent settings. It uses normal agent invocation privileges. calendar_sync will create calendar events (expected behavior) but only on macOS via AppleScript.

Assessment

This skill appears to do what it says: it needs your Canvas API token (stored in config.json) so only provide a token with the minimum necessary scope and keep the file private. Be aware the scripts will read/write local files (downloads, extracted Markdown) and will create Apple Calendar events on macOS when you run calendar_sync.py. There are a few non-security issues you should review before trusting the skill: (1) submit_assignment contains a string-formatting bug in its upload URL construction — it will likely fail and should be corrected to use f"{get_base_url()}/api/v1/..."; (2) file_extractor supports DOCX but SKILL.md/README omit python-docx in the pip install instructions (the extractor will return an instruction if python-docx is missing); (3) always confirm before allowing any automated submission — the SKILL.md notes this, and you should verify local file paths and files to be uploaded. If you want extra assurance, inspect the code locally or run the scripts in a controlled environment (e.g., a throwaway account) before pointing them at your primary Canvas account.

Canvas LMS 课程管理技能，默认配置为上海交通大学 (oc.sjtu.edu.cn)，也兼容其他 Canvas LMS 实例。

首次配置

1. 复制配置模板并填入你的 Canvas API Token：

cp skills/sjtu-canvas/config.example.json skills/sjtu-canvas/config.json

2. 编辑 config.json，填入：

   • canvas_token: 从 Canvas → 设置 → 新建访问令牌 获取
   • base_url: 你的 Canvas 地址（默认 https://oc.sjtu.edu.cn）
   • save_dir: 课件下载目录（默认 ~/Downloads/Canvas课件）
   • calendar_name: Apple 日历分类名（默认 Canvas作业）

3. 安装依赖：

pip3 install python-pptx pdfplumber requests

核心脚本

所有脚本位于 skills/sjtu-canvas/scripts/，用 python3 执行。

canvas_api.py — Canvas API 交互

# 列出课程
python3 scripts/canvas_api.py courses

# 查看所有未来DDL
python3 scripts/canvas_api.py ddls

# 查看已出成绩
python3 scripts/canvas_api.py grades

Python 中调用:

import sys; sys.path.insert(0, "skills/sjtu-canvas/scripts")
from canvas_api import *

list_courses()                          # 课程列表
list_assignments(course_id)             # 作业列表
get_all_upcoming_ddls()                 # 所有未来DDL
get_course_grades(course_id)            # 成绩
list_course_files(course_id)            # 课程文件
download_course_files(cid, name, dir)   # 批量下载
list_discussions(course_id)             # 讨论区
get_full_discussion(cid, topic_id)      # 讨论详情
submit_assignment(cid, aid, [paths])    # 提交作业

file_extractor.py — 课件内容提取

# 提取单个文件
python3 scripts/file_extractor.py path/to/file.pptx

# 批量提取目录 → Markdown
python3 scripts/file_extractor.py ~/Downloads/Canvas课件/传热学 ~/Downloads/Canvas课件/传热学_md

支持格式: .pptx .pdf .docx .txt .md

calendar_sync.py — DDL → Apple 日历 (macOS)

cd skills/sjtu-canvas && python3 scripts/calendar_sync.py

自动创建日历分类，已存在的事件不会重复创建。通过 iCloud 同步到 iPhone。

工作流

1. 课件下载 + 总结

1. canvas_api.download_course_files() 下载课程 PPT/PDF
2. file_extractor.extract_file() 提取文本
3. 用 LLM 总结要点

2. 作业辅导

1. canvas_api.get_assignment() 获取作业要求
2. 下载相关课件并提取内容
3. 结合作业要求和课件，给出解题思路

3. DDL 管理

1. canvas_api.get_all_upcoming_ddls() 获取所有未来 DDL
2. calendar_sync.sync_ddls() 同步到 Apple 日历
3. 可设置 cron 定时巡检

4. 成绩追踪

1. canvas_api.get_course_grades() 获取各科成绩
2. 计算加权均分

5. 期末复习包

1. canvas_api.download_course_files() 批量下载课件
2. file_extractor.batch_extract() 批量提取为 Markdown
3. 导入 NotebookLM 或其他工具复习

6. 提交作业

1. 确认课程 ID、作业 ID、本地文件
2. canvas_api.submit_assignment() 提交
3. 提交前必须向用户确认

注意事项

• 提交作业前必须向用户确认
• Canvas Token 有效期可能有限，失效时需重新生成
• Apple 日历同步仅支持 macOS
• 非 SJTU 用户需修改 config.json 中的 base_url