ClawHub
Back to skill

Security audit

Moodle Claw

Security checks for vulnerabilities and agentic risk

Overview

The Moodle purpose is clear, but the skill asks users to install an external binary and handle Moodle credentials and bulk course downloads in ways that need careful review.

Review this before installing. Prefer the interactive configuration flow, avoid putting Moodle passwords or token URLs in shell commands or chat transcripts, and confirm where credentials are stored. Treat whole-course syncs as bulk downloads of potentially sensitive material; choose a destination deliberately and avoid `--no-confirm` unless you have already reviewed the scope. Only run the downloaded binary if you trust the publisher and release provenance beyond the included checksum.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Execution of an Unverifiable Precompiled Dependency

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:41
Finding

Moodle Credentials Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
URL="https://github.com/4strium/moodle-claw/releases/download/v1.0/moodle-claw"
SHA256="0ce9e6ad4e42c626ebe2c4ce79bde23da3386dc8e4b54a87da0a345a1a0252aa"

curl -L -o moodle-claw "$URL"
echo "$SHA256 moodle-claw" | sha256sum -c -
chmod +x moodle-claw

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

--no-confirm is a dangerous parameter in the context of a tool that can sync large sets of course files, because it suppresses an important safeguard before a write-heavy and potentially sensitive action. In an automated environment, this can be abused or accidentally triggered to perform unreviewed bulk exfiltration-like downloads to local storage.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

Sync Course

bash
moodle-claw sync "Course Name" [--dest ~/Courses] [--no-confirm]
moodle-claw sync  # syncs all enabled courses

Downloads all files from a course.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
87% confidence
Finding

The offline workflow recommends a --no-confirm full-course sync, which turns a high-impact parameter into the default operational path for the agent. This materially increases the risk of unintended mass download of educational content and associated privacy, storage, and compliance issues.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
3. The extracted text will be included in the output for you to analyze

### When user wants to work offline
1. Sync the entire course: `moodle-claw sync "Course Name" --no-confirm`
2. Files will be available locally for reading

## Output Formats

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The example command for downloading all course files includes --no-confirm, directly modeling use of a risky parameter for bulk content acquisition. In practice, this can facilitate unreviewed collection of potentially sensitive course materials and make misuse by an automated assistant more likely.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

User: "Télécharge tous les fichiers du cours de physique"

bash
moodle-claw sync "Physique" --no-confirm

Notes

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup instructions ask users to supply highly sensitive authentication material, including tokens, SSO redirect URLs containing access tokens, and usernames/passwords, without clear guidance on secure handling. In a skill or agent environment, these secrets may be exposed in command history, logs, transcripts, screenshots, or copied output, enabling account compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill encourages downloading individual files and syncing entire courses to local storage, but it does not clearly warn that these actions write potentially large amounts of course data onto the host machine. In an agent setting, this can lead to unintended bulk data collection, privacy issues, disk consumption, and persistence of sensitive educational materials beyond the user's expectations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

Documenting --no-confirm for course sync lowers the barrier to unattended bulk actions and encourages operation without an interactive safety check. In an agent-driven workflow, that can enable accidental or over-broad downloads of course materials without the user reviewing scope, destination, or data sensitivity.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

Sync Course

bash
moodle-claw sync "Course Name" [--dest ~/Courses] [--no-confirm]
moodle-claw sync  # syncs all enabled courses

Downloads all files from a course.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The usage pattern explicitly recommends syncing an entire course with --no-confirm for offline work, normalizing unattended mass download behavior. This increases the chance that an automated assistant performs broad local data collection without meaningful user review.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
3. The extracted text will be included in the output for you to analyze

### When user wants to work offline
1. Sync the entire course: `moodle-claw sync "Course Name" --no-confirm`
2. Files will be available locally for reading

## Output Formats

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The example response to downloading all physics course files uses --no-confirm, reinforcing autonomous execution of a potentially sensitive and high-volume action. For agent users, this can bypass a natural checkpoint before writing many files locally.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

User: "Télécharge tous les fichiers du cours de physique"

bash
moodle-claw sync "Physique" --no-confirm

Notes

Static analysis

No suspicious patterns detected.