The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The error handling implementation guide (Step 6) includes instructions to create a log directory using mkdir($logdir, 0777, true). This command sets world-writable and world-executable permissions on the directory, allowing any local user on the server to read, write, or delete files within that location, which can lead to system compromise or data tampering.
[DATA_EXFILTRATION]: The log_debug function implementation in Step 6 records sensitive technical information to a local file. This includes the full stack trace ($e->getTraceAsString()) and the last executed SQL query ($DB->get_last_sql()). If the log file or its directory is misconfigured or world-readable (as suggested by the 0777 permission in the same section), this data can expose internal database schemas, query logic, and sensitive environment details to unauthorized parties.
[INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to build APIs that ingest and process untrusted data from external web service requests. While the guide includes mandatory validation steps, the nature of processing user-controlled input for database and system operations creates an inherent attack surface for indirect injections.
Ingestion points: External web service parameters (e.g., userid, courseid, and arbitrary structures) processed in the execute() method.
Boundary markers: Relies on Moodle's internal validate_parameters framework and constant-based type checking.
Capability inventory: Extensive capabilities including arbitrary database reads/writes (get_records_sql, insert_record), file system writes via the logging helper, and course module configuration.
Sanitization: Encourages the use of Moodle's PARAM_* cleaning constants, which provide basic filtering but may not prevent complex logical or prompt-based injections in downstream LLM contexts.

moodle-external-api-development