skills/sebas-aikon-intelligence/antigravity-awesome-skills/moodle-external-api-development/Gen Agent Trust Hub
moodle-external-api-development
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for building web service APIs that process external input, creating a surface for indirect prompt injection if malicious data is passed to the agent via these endpoints.\n
- Ingestion points: Web service API parameters defined in the execute_parameters method (SKILL.md).\n
- Boundary markers: The skill recommends using Moodle's external_function_parameters for schema definition and validate_parameters for input validation.\n
- Capability inventory: The skill demonstrates database operations ($DB), file system writes for logging, and course module management.\n
- Sanitization: The guide suggests using Moodle PARAM_* types for sanitization, but notes that PARAM_RAW can be used, which performs no cleaning of input.\n- [PRIVILEGE_ESCALATION]: The implementation example for log_debug (Step 6) uses mkdir($logdir, 0777, true) to create a log directory. Setting world-writable permissions (0777) is a security risk that could allow unauthorized users on the host system to read, modify, or delete log files, potentially exposing sensitive database traces captured in the logs.
Audit Metadata