The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The code implementation in Step 6 and the Advanced Patterns section recommends creating a logging directory using mkdir($logdir, 0777, true);. Setting world-writable (0777) permissions on directories violates the principle of least privilege, allowing any user on the host system to read, write, or delete files within that directory.
[DATA_EXFILTRATION]: The example logging function in Step 6 records sensitive diagnostic information to a persistent file, including the full application stack trace via $e->getTraceAsString() and the last executed SQL query via $DB->get_last_sql(). Exposing internal code structure and database schemas in log files represents a significant data leakage risk if the filesystem or logging directory is not properly restricted.
[INDIRECT_PROMPT_INJECTION]: The skill describes the creation of an API that ingests untrusted user input, creating a potential vector for indirect prompt injection if that data is processed by further LLM-based tools.
Ingestion points: Input parameters are defined in execute_parameters() and received by the execute() method in SKILL.md (e.g., userid, courseid, tagname).
Boundary markers: Absent; the code examples do not demonstrate the use of delimiters or specific instructions to isolate or ignore embedded commands within the processed data.
Capability inventory: The API implementation has access to database operations ($DB), course module management (add_course_module), and group administration.
Sanitization: Present; the skill correctly advocates for Moodle's built-in parameter validation (validate_parameters) and uses appropriate PARAM_* types and parameterized queries.

moodle-external-api-development