The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The implementation example for error logging uses mkdir($logdir, 0777, true), which creates a directory with world-writable, world-readable, and world-executable permissions. This is a security risk as it allows any local user on the system to add, modify, or delete files in the logging directory.
[DATA_EXFILTRATION]: The error handling logic logs detailed technical information, including the last executed SQL query and full PHP stack traces, to a log file within the world-writable directory mentioned above. This could expose internal database structures and sensitive logic to unauthorized local users.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of API endpoints that ingest untrusted data from external sources via execute_parameters. While it mentions Moodle's parameter validation system, the architecture described creates a surface for indirect prompt injection if the ingested data is used in downstream agent tasks or processed without strict sanitization.
Ingestion points: API parameters defined in execute_parameters and processed in the execute method in SKILL.md.
Boundary markers: The guide suggests validate_parameters but does not include explicit instructions for ensuring that user-provided content cannot be misinterpreted as instructions by an agent.
Capability inventory: The skill demonstrates database interactions via Moodle's $DB API and local file system operations via file_put_contents and mkdir.
Sanitization: Recommends using Moodle's built-in parameter types (e.g., PARAM_INT, PARAM_TEXT) and the validate_parameters function, which provides a baseline level of protection.

moodle-external-api-development