moodle-external-api-development
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive and secure instructions for developing Moodle External APIs, explicitly requiring the use of Moodle's core security functions such as
validate_parameters(),validate_context(), andrequire_capability()to enforce authorization. - [SAFE]: All database examples utilize Moodle's Data Manipulation Layer (DML) with parameterized SQL queries, which effectively prevents SQL injection vulnerabilities.
- [SAFE]: The documentation includes strong security advisories, warning developers against logging sensitive data (like tokens or raw SQL), hardcoding credentials, or using production tokens in insecure environments.
- [SAFE]: The skill emphasizes the principle of least privilege, instructing users to create specific test roles and use synthetic data rather than administrative accounts for development and testing.
- [SAFE]: Code fragments include necessary security guards (e.g.,
defined('MOODLE_INTERNAL') || die();) to prevent direct file access, which is a standard security practice in the Moodle ecosystem.
Audit Metadata