T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:30- Finding
Moodle API Token Disclosed to a Hardcoded Third-Party Host
- Content
View full analysis
- Remediation
View remediation
Security audit
moodle
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it can send a Moodle API token to a hardcoded default server if the user does not set MOODLE_URL.
Install only if you explicitly set MOODLE_URL to your trusted Moodle server before using the skill. Treat MOODLE_TOKEN as a secret, avoid storing it in shared files or shell history, and rotate the token if it may have been sent to the default mylms.vossie.net endpoint.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
mod_assign_get_assignmentsis the primary course-discovery endpoint. It returns every enrolled course with itsid,fullname,shortname, and any assignments:bash curl -s "${MOODLE_URL:-https://mylms.vossie.net}/webservice/rest/server.php" \ --get \ --data-urlencode "wstoken=$MOODLE_TOKEN" \ --data-urlencode "wsfunction=mod_assign_get_assignments" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
mod_assign_get_assignmentsis the primary course-discovery endpoint. It returns every enrolled course with itsid,fullname,shortname, and any assignments:bash curl -s "${MOODLE_URL:-https://mylms.vossie.net}/webservice/rest/server.php" \ --get \ --data-urlencode "wstoken=$MOODLE_TOKEN" \ --data-urlencode "wsfunction=mod_assign_get_assignments" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Use
core_course_get_contentswith a course ID (frommod_assign_get_assignmentsabove):bash curl -s "${MOODLE_URL:-https://mylms.vossie.net}/webservice/rest/server.php" \ --get \ --data-urlencode "wstoken=$MOODLE_TOKEN" \ --data-urlencode "wsfunction=core_course_get_contents" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Check activity completion
bash curl -s "${MOODLE_URL:-https://mylms.vossie.net}/webservice/rest/server.php" \ --get \ --data-urlencode "wstoken=$MOODLE_TOKEN" \ --data-urlencode "wsfunction=core_completion_get_activities_completion_status" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to generate and store a Moodle web service token, but it does not warn that this token is a sensitive credential equivalent to API authentication. Users may place it in shell history, world-readable config files, screenshots, or shared dotfiles, increasing the chance of credential theft and unauthorized access to Moodle data.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Option A: OpenClaw workspace install
bash mkdir -p ~/.openclaw/skills/moodle cp SKILL.md ~/.openclaw/skills/moodle/SKILL.md
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash mkdir -p ~/.openclaw/skills/moodle cp SKILL.md ~/.openclaw/skills/moodle/SKILL.mdOption B: ClawHub (if published)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill repeatedly instructs users to send a bearer-like Moodle access token and potentially sensitive LMS metadata over network requests, but it provides no privacy or security warning about token handling, data exposure, or the trust implications of setting a custom MOODLE_URL. This is especially risky because the token is user-scoped and the default/fallback endpoint is a third-party domain, so users may unknowingly disclose educational records and credentials to an unintended server.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file states that the skill accesses Moodle via the REST API and can list courses, assignments, and course content, but it does not explicitly warn users that their requests and associated LMS data will be transmitted to their Moodle instance. Because this behavior affects user data/privacy, the markdown should disclose it clearly.
- Content