New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Canvas Setup

by X-isdoingreat in X-isdoingreat/canvas-pilot

A skill your agent uses for first-run Canvas Pilot configuration or recovery when the Canvas host, local runtime, authentication, or route setup is incomplete.

AGPL-3.0Auto-check: notesBackend & APIs

Install Canvas Setup

skills CLI
$ npx skills add X-isdoingreat/canvas-pilot --skill canvas-setup -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install X-isdoingreat/canvas-pilot canvas-setup --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/X-isdoingreat/canvas-pilot.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/canvas-setup .claude/skills/canvas-setup && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
canvas-setup
GitHub stars
125
Token cost
~2.6k tokens
SKILL.md length
1,392 words
Files
1
Skills in repo
32
Repo updated
First seen
Licence
AGPL-3.0

At a glance

A skill your agent uses for first-run Canvas Pilot configuration or recovery when the Canvas host, local runtime, authentication, or route setup is incomplete.

  • Works in 6 steps: Inspect, classify, and preserve → Resolve and write the Canvas host → Prepare the local runtime → …
  • First-run Canvas Pilot configuration
  • SKILL.md covers Non-negotiable boundary, Student experience, Resume from observed state and Deterministic workflow, plus 1 more section
  • Calls python; needs CANVAS_REMEMBER_CREDENTIALS

What it does

Canvas Setup is an agent skill from X-isdoingreat/canvas-pilot. Use for first-run Canvas Pilot configuration or recovery when the Canvas host, local runtime, authentication, or route setup is incomplete. It performs the mechanical setup, verifies authentication, then hands empty-route installs to canvas-skill-opportunity and stops.

Its SKILL.md is about 2.6k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Authentication. The repository describes itself as: Local-first Canvas LMS AI agent that learns each course's recurring assignment workflow and reuses it through scan - approval - execute with student review. The licence is AGPL-3.0.

When your agent uses it

  • First-run Canvas Pilot configuration
  • Recovery when the Canvas host
  • Route setup is incomplete

Example prompts

  • “/canvas-setup”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Inspect, classify, and preserve
  2. Resolve and write the Canvas host
  3. Prepare the local runtime
  4. Protect credentials and authenticate
  5. Create or preserve empty route configuration
  6. Opportunity handoff and hard stop

What it can do on your machine

Read from SKILL.md and the folder at commit 6b79d5b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • CANVAS_REMEMBER_CREDENTIALS

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Canvas Setup loads about 2.6k tokens when it runs. Until then it costs about 71 tokens; SKILL.md has 1,392 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~71
When it runs · the whole SKILL.md, loaded when a task matches
~2.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:59
    Do not tell the student to edit `.env`, run shell commands, inspect internal config files,
  • NoteMentions a .env fileSKILL.md:81
    | `.env` missing or Canvas host empty | Ask school first; ask for the login URL only if official-host resolution is ambi
  • NoteMentions a .env fileSKILL.md:99
    Read `AGENTS.md`, `.env` if present, `courses.yaml` if present, tracked setup
  • NoteMentions a .env fileSKILL.md:101
    `.env`. Preserve an existing deliberate token mode and token value. Treat

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from X-isdoingreat/canvas-pilot at commit 6b79d5b, republished under its AGPL-3.0 licence (© X-isdoingreat). 1,392 words, ~2,584 tokens.

Download SKILL.mdSave it as .claude/skills/canvas-setup/SKILL.md (or your agent's skills folder).
name
canvas-setup
description
Use for first-run Canvas Pilot configuration or recovery when the Canvas host, local runtime, authentication, or route setup is incomplete. It performs the mechanical setup, verifies authentication, then hands empty-route installs to canvas-skill-opportunity and stops.

Canvas Setup

Set up or repair Canvas Pilot without turning setup into a technical tutorial. The student supplies only facts that Codex cannot discover and completes one normal browser login when needed. Codex performs local checks, installs, configuration edits, and verification itself.

Setup is not a scan or assignment workflow. It must never inspect pending assignments, create a plan, draft work, start a quiz attempt, upload, or submit.

Non-negotiable boundary

  • Keep .claude/ read-only. It is frozen legacy history, not an active setup surface.
  • Do not scan assignments.
  • Do not execute assignments.
  • Do not submit, upload, or answer quizzes.
  • Do not write assignments.json, plan.json, result.json, REPORT.md, or .scan_in_progress.
  • Do not write assignments.json, plan.json, result.json, or REPORT.md.
  • Do not create a course skill or route directly from setup.
  • Successful authentication with empty routes hands off to canvas-skill-opportunity; that skill performs read-only evidence review and stops for the student's numbered choice. Only a later, separate canvas-bootstrap invocation may create one selected skill and route. The student's choice comes before any later canvas-bootstrap handoff.
  • Authentication is not assignment approval. It grants no authority to start, answer, or complete a quiz, upload a file, or submit an assignment.
  • Never copy a private identity, school, account, credential, course identifier, teaching-staff details, email, or private URL into a tracked file or public message.

Student experience

Open with the value in the language the student used:

I’ll connect Canvas, find recurring work worth automating, and show you the evidence before any course skill is created. Drafting and submission remain separate approvals. Want to start?

After consent, ask one domain question per turn. For an unconfigured install, the first question is:

Which school do you use Canvas through?

Ask the student only domain questions. School name first; use the Canvas login URL only as the ambiguity fallback.

Use the answer to discover the school's official Canvas login host. Search the public web when necessary and verify the candidate host has a Canvas/Instructure login signature. If no single official host can be established, ask for the Canvas login-page URL. Never guess a host from a school name. Normalize only to the origin (https://host) and derive the API base from that origin.

Do not tell the student to edit .env, run shell commands, inspect internal config files, install a package, find a token menu, inspect a cookie, or copy internal IDs. Do those mechanical tasks with local tools. Keep internal vocabulary out of ordinary student-facing messages unless the student explicitly asks for implementation details.

Before a browser login, say that a local browser window will open and that the student should sign in normally, including SSO/2FA. Explain that the default stores a local browser session but does not save the username/password. Do not ask the student to paste credentials into chat.

For an operation likely to exceed 30 seconds, give one time estimate and report only meaningful numeric progress. Do not emit repeated “still waiting” updates when nothing changed.

Resume from observed state

Inspect the filesystem before asking anything. Never ask “where did we leave off?” when the answer is local.

Observed stateResume action
.env missing or Canvas host emptyAsk school first; ask for the login URL only if official-host resolution is ambiguous.
Host present, runtime dependency missingInstall/repair the isolated runtime silently, then continue.
Browser auth configured but no usable local sessionExplain the browser popup, run login/probe, and continue only on verified success.
Token auth already configured deliberatelyPreserve the token mode and token value; probe it without advertising or rewriting it.
Auth probe fails as expired/unauthorizedRe-enter the matching browser or token recovery path; do not proceed to opportunity analysis.
Auth works, courses.yaml missingCreate a minimal local config with the configured pending window and routes: {}.
Auth works, routes empty/nullHand off to canvas-skill-opportunity, then stop.
Auth works, routes non-emptyReport setup complete; name canvas-scan as the next user action and stop.

If the student explicitly asks to redo setup, first ask which material fact changed (school/host, authentication, or routes). Preserve unrelated working configuration. Never silently replace a working configuration or delete a browser profile.

Deterministic workflow

1. Inspect, classify, and preserve

Read AGENTS.md, .env if present, courses.yaml if present, tracked setup examples, and the documented probe entry point. Preserve all non-Canvas keys in .env. Preserve an existing deliberate token mode and token value. Treat routes: null as an empty mapping.

Classify the install as one of:

  1. host_missing
  2. runtime_missing
  3. authentication_missing_or_expired
  4. authenticated_empty_routes
  5. ready

Compatibility names used by older checks map as follows: missing-env and incomplete-canvas-config are pre-auth states; auth-configured-empty-routes is authenticated_empty_routes; complete is ready. These are state labels only, not alternate workflows.

Perform only the steps needed to advance that state. A failure stops at the state it actually reached; never announce readiness from configuration shape alone.

2. Resolve and write the Canvas host

After the official login origin is verified, update only the relevant Canvas host fields atomically. Preserve unrelated environment settings. Do not put the school name or host into tracked docs, skills, examples, or tests.

The default authentication path is local browser/session auth. Token auth is an advanced recovery path only when the project supports it and the student chooses it or already configured it. Never expose a token in command output or chat.

Show full SKILL.md (517 more words)Show less
3. Prepare the local runtime

Use an isolated Python environment. A repo-local .venv/ is acceptable only after confirming it is gitignored. Install tracked requirements and the matching browser component with the active interpreter; on Windows use full paths and UTF-8 output. Bundle dependent install steps so a failed prerequisite stops the sequence.

The interpreter-equivalent commands are:

text
python -m pip install -r requirements.txt
python -m playwright install chromium

Before installing, run a bounded import-and-browser-launch check. Skip install silently when the check passes. If installation fails, retain the real failure in a private local log, translate it into plain language, and offer one retry.

4. Protect credentials and authenticate

Keep CANVAS_REMEMBER_CREDENTIALS=false unless the student explicitly opts in to password autofill. For opt-in storage, continue only when the project's credential helper reports a protected method such as DPAPI or Fernet. Base64 obfuscation is not protected storage and must never be used for a new secret. Probe the configured method through canvas_credentials._pick_method(). Never write new credentials with base64 obfuscation.

For the default browser path:

  1. tell the student the browser is about to open;
  2. run python -m src.canvas_client --probe with the isolated interpreter;
  3. let the student complete normal SSO/2FA in the browser;
  4. after success, use python -m src.canvas_client --forget-credentials to remove any legacy opt-in username/password record;
  5. verify has_stored_credentials() is false;
  6. probe once more and continue only if the retained local browser session still authenticates.

For an existing token path, run only the auth probe and preserve the token.

Classify failures without dumping a traceback:

  • unauthorized/expired: recover authentication;
  • login timeout: ask whether the browser failed to open or login was blocked;
  • network/browser-engine failure: offer one retry after the connection works;
  • unknown: show a short sanitized detail and stop for direction.

An auth probe may validate identity and connectivity only. It must not list assignments or perform any Canvas mutation.

5. Create or preserve empty route configuration

If authentication works and courses.yaml is missing, atomically create the minimal local configuration expected by the current router, including pending_window_days and routes: {}. If it exists, preserve every existing route and unrelated key. Never replace non-empty routes during recovery.

6. Opportunity handoff and hard stop

When authentication is verified and routes are empty, invoke canvas-skill-opportunity with this intent:

Authentication is verified and routes are empty. Inspect recurring candidates read-only, inspect representative real specifications and safe feedback-policy projections, write the private opportunity report, show only numbered aliases in chat, and stop for the student's choice.

After that handoff returns, stop setup. Do not scan pending work, do not call canvas-bootstrap, and do not create a route in the same turn.

When routes are already non-empty, say setup is ready and that canvas-scan is the next action. Stop without invoking scan.

Verification checklist

Before reporting success, verify:

  • the official Canvas origin was established rather than guessed;
  • local configuration is syntactically valid and preserves unrelated keys;
  • the active auth probe succeeded in the current process environment;
  • default browser auth has no persisted username/password record;
  • route configuration is either intentionally empty or already populated;
  • empty routes went to canvas-skill-opportunity, not directly to bootstrap;
  • no assignment snapshot, plan, result, report, marker, quiz attempt, upload, or submission was created.

© X-isdoingreat, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/canvas-setup of X-isdoingreat/canvas-pilot.

Open the folder on GitHubat commit 6b79d5b

Compare with similar skills

Canvas Setup next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Canvas Setup compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Canvas Setup this skillX-isdoingreat/canvas-pilot125—~2.6kAutomated safety check: NotesAGPL-3.0
Fortify Developmentcoollabsio/coolify63k4 repos~1.9kAutomated safety check: PassMIT
Supabase Development and Debuggingsupabase/agent-skills2.7k3 repos~3.6kAutomated safety check: PassMIT
Better Auth Best Practiceslatitude-dev/latitude-llm4.7k7 repos~1.6kAutomated safety check: PassMIT
Gitnexus Exploringaws-samples/sample-kolya-br-proxy10612 repos~749Automated safety check: PassMIT-0
Supabasecurvenote/curvenote1705 repos~2.2kAutomated safety check: PassCustom licence

Similar skills

  • Fortify Development

    coollabsio/coolify

    ACTIVATE when the user works on authentication in Laravel. An agent skill from coollabsio/coolify.

    63k GitHub starsUsed in 4 repos~1.9k tokens
    Backend & APIsAuto-check passed

  • Supabase Development and Debugging

    supabase/agent-skills

    Official

    General Supabase skill for database, auth, Edge Functions, Realtime and storage work, plus client libraries, migrations, security audits, debugging and reading logs.

    2.7k GitHub starsUsed in 3 repos~3.6k tokens
    Backend & APIsAuto-check passed

  • Better Auth Best Practices

    latitude-dev/latitude-llm

    Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables.

    4.7k GitHub starsUsed in 7 repos~1.6k tokens
    Backend & APIsAuto-check passed

  • Gitnexus Exploring

    aws-samples/sample-kolya-br-proxy

    Official

    A skill your agent uses when the user asks how code works, wants to understand architecture, trace execution flows, or explore unfamiliar parts of the codebase.

    106 GitHub starsUsed in 12 repos~749 tokens
    Backend & APIsAuto-check passed

  • Supabase

    curvenote/curvenote

    A skill your agent uses when doing ANY task involving Supabase.

    170 GitHub starsUsed in 5 repos~2.2k tokens
    Backend & APIsAuto-check passed

  • Gemini Live API Dev

    google-gemini/gemini-skills

    Official

    A skill your agent uses when building real-time, bidirectional streaming applications with the Gemini Live API, or migrating legacy Live models (2.0/2.5/3.1) to Gemini 3.8 Live.

    4.3k GitHub stars~4.6k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed

More from X-isdoingreat/canvas-pilot

All 32 skills in this repo

  • Daily Work Tweet

    X-isdoingreat/canvas-pilot

    A skill your agent uses when verified work from today or another day should become an X/Twitter post, build-in-public update, ship log, or bilingual draft.

    125 GitHub stars~1.6k tokensUpdated 2 mo ago
    Auto-check passed

  • Canvas Awkward Syntax

    X-isdoingreat/canvas-pilot

    A skill your agent uses when a short local academic draft needs role-aware syntax diversification while preserving meaning, locks, source grounding, rubric-critical openings, and document structure.

    125 GitHub stars~2k tokensUpdated 2 mo ago
    Auto-check passed

  • Canvas Cron

    X-isdoingreat/canvas-pilot

    A skill your agent uses when managing Canvas Pilot schedules: install, inspect, pause, change, delete, or safely test scheduled scans and runs.

    125 GitHub stars~2.1k tokensUpdated 2 mo ago
    Auto-check: notes

  • Canvas Essay

    X-isdoingreat/canvas-pilot

    A skill your agent uses for an approved long academic-writing assignment routed by canvas-execute after the deterministic writing router selects essay.

    125 GitHub stars~2.2k tokensUpdated 2 mo ago
    Auto-check passed

  • Canvas Generic

    X-isdoingreat/canvas-pilot

    A skill your agent uses for an approved Canvas assignment that no specialized course skill can handle.

    125 GitHub stars~2.4k tokensUpdated 2 mo ago
    Auto-check passed

  • Canvas Humanizer

    X-isdoingreat/canvas-pilot

    A skill your agent uses when a local academic draft needs a meaning-preserving humanizing pass with less uniform syntax while retaining rubric, source, lock, voice, and length constraints.

    125 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed

Categories

Questions about Canvas Setup

What does Canvas Setup do?

A skill your agent uses for first-run Canvas Pilot configuration or recovery when the Canvas host, local runtime, authentication, or route setup is incomplete. Canvas Setup is an agent skill from X-isdoingreat/canvas-pilot. Use for first-run Canvas Pilot configuration or recovery when the Canvas host, local runtime, authentication, or route setup is incomplete.

When should I use Canvas Setup?

Canvas Setup fits situations like: first-run Canvas Pilot configuration; recovery when the Canvas host; route setup is incomplete.

How do I install Canvas Setup in Claude Code?

Run `npx skills add X-isdoingreat/canvas-pilot --skill canvas-setup -a claude-code`. Or copy the skill folder (.agents/skills/canvas-setup in X-isdoingreat/canvas-pilot) into .claude/skills/canvas-setup in your project. Claude Code loads it when a task matches its description.

How do I install Canvas Setup in Codex?

Run `npx skills add X-isdoingreat/canvas-pilot --skill canvas-setup -a codex`. Or copy the skill folder (.agents/skills/canvas-setup in X-isdoingreat/canvas-pilot) into .agents/skills/canvas-setup in your project. Codex loads it when a task matches its description.

Can I use Canvas Setup in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add X-isdoingreat/canvas-pilot --skill canvas-setup -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/canvas-setup, .gemini/skills/canvas-setup, .github/skills/canvas-setup and .opencode/skills/canvas-setup in your project.

What does Canvas Setup need to run?

Going by SKILL.md and its folder, Canvas Setup needs the command-line tools its instructions call (python) and credentials named CANVAS_REMEMBER_CREDENTIALS. Our summary lists: Python 3.

Does Canvas Setup access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Canvas Setup safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Canvas Setup use?

Canvas Setup is published under the AGPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Canvas Setup use?

About 2.6k tokens (SKILL.md is roughly 10k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Canvas Setup?

Skills that share tags, products or a category with Canvas Setup: Fortify Development (coollabsio/coolify, 63k stars), Supabase Development and Debugging (supabase/agent-skills, 2.7k stars), Better Auth Best Practices (latitude-dev/latitude-llm, 4.7k stars) and Gitnexus Exploring (aws-samples/sample-kolya-br-proxy, 106 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Canvas Setup?

X-isdoingreat (a GitHub user) maintains it in X-isdoingreat/canvas-pilot, which has 125 GitHub stars. The repository holds 32 skills in this directory. The repository was last updated on July 31, 2026.

Source: X-isdoingreat/canvas-pilot on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.