moodle-external-api-development
Warn
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The provided PHP logging function implementation in
SKILL.mdusesmkdir($logdir, 0777, true). Setting world-writable permissions (0777) on directories created by the web server is a security risk that can allow unauthorized local users to modify, delete, or inject malicious files into the application directory. - [DATA_EXFILTRATION]: The skill's error handling examples include logging sensitive system information such as the last executed SQL query via
$DB->get_last_sql()and full execution stack traces via$e->getTraceAsString(). Storing this level of technical detail in log files, particularly in directories with insecure permissions, facilitates information disclosure that can be used to map the database structure or identify further vulnerabilities.
Audit Metadata