Security Audit
moodle-external-api-development
github.com/sickn33/antigravity-awesome-skillsTrust Assessment
moodle-external-api-development received a trust score of 73/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 1 high, 2 medium, and 0 low severity. Key findings include Sensitive environment variable access: $USER, Insecure directory permissions (0777) for log files, Logging of raw SQL queries and stack traces.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 20, 2026 (commit e36d6fd3). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Insecure directory permissions (0777) for log files The `log_debug` function creates a log directory using `mkdir($logdir, 0777, true);`. Setting directory permissions to `0777` makes it world-writable, allowing any user on the system to read, write, or execute files within it. This can lead to unauthorized data modification, injection of malicious scripts, or exposure of sensitive log data. Change directory permissions to a more restrictive value, such as `0755` (owner read/write/execute, group read/execute, others read/execute) or `0700` (owner only), depending on the specific requirements and environment. For Moodle, `0755` is generally recommended for directories. | LLM | SKILL.md:189 | |
| MEDIUM | Sensitive environment variable access: $USER Access to sensitive environment variable '$USER' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated. | Static | skills/moodle-external-api-development/SKILL.md:90 | |
| MEDIUM | Logging of raw SQL queries and stack traces The error handling example logs `$lastsql` (the last executed SQL query) and `$e->getTraceAsString()` (the full stack trace) in debug logs. While useful for development, in a production environment, this can expose sensitive information such as database schema details, internal file paths, and potentially even data if SQL queries contain literals or stack traces reveal variable contents. This poses a data exfiltration risk if log files are not adequately secured. In production environments, avoid logging raw SQL queries and full stack traces directly to publicly accessible or insecure log files. Consider redacting sensitive parts of SQL queries, logging only essential error messages, or using a secure logging mechanism that restricts access to detailed error information. Ensure log files themselves have restrictive permissions. | LLM | SKILL.md:219 |
Scan History
Embed Code
[](https://skillshield.io/report/fc5e6fd44667bbc3)
Powered by SkillShield