Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Moodle Connector Skill
v1.0.0Moodle REST API client, batch downloader, and MCP server for Claude Code integration
⭐ 0· 53·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code implements a Moodle REST client, batch downloader, and MCP server which matches the stated purpose. However the SKILL metadata declares no required environment variables while SKILL.md and the code expect an encryption password / tokens (MOODLE_CRED_PASSWORD, config.json with web_service_token). That mismatch between declared requirements and what the skill actually needs is incoherent.
Instruction Scope
SKILL.md instructs adding MOODLE_CRED_PASSWORD in claude_desktop_config.json (putting the encryption password into an agent config file) and enabling an MCP server that gives the agent direct access to Moodle functions. The code, however, contains mismatches: mcp_server.py constructs the connector with a hard-coded password ('test-pass') instead of reading the env var, and batch_downloader references os.getenv without importing os. The SKILL.md also claims 'no telemetry' and 'safe for headless' even though the code uses Playwright for interactive SSO (and launches a non-headless browser in the truncated snippet).
Install Mechanism
This is instruction-only (no install spec in registry) and the repo includes requirements.txt and a package.json 'install' script that runs pip and playwright. No remote downloads or obscure installers are present in the package itself, but following the published install steps will install third-party packages and Playwright (which will download browser binaries).
Credentials
The skill expects sensitive inputs (Moodle webservice token in config.json and an encryption password). The registry lists no required env vars, yet SKILL.md requires MOODLE_CRED_PASSWORD. SKILL.md recommends putting that password directly into claude_desktop_config.json (cleartext in agent config) — this is disproportionate and risky. The code writes encrypted credentials to disk, but the hard-coded 'test-pass' in mcp_server undermines that model and could cause incorrect behavior or require storing secrets elsewhere.
Persistence & Privilege
The skill is not marked always:true. The main persistence concern is operational: the MCP server runs as a long-lived tool and the SKILL.md tells the user to add it to claude_desktop_config.json with the MOODLE_CRED_PASSWORD — that gives any agent with access to that MCP configuration the ability to call Moodle on the user's behalf. This is expected for an MCP integration but increases blast radius; combine with the secret-in-config guidance it becomes riskier.
What to consider before installing
What to check before installing or enabling this skill:
- Do not blindly paste your encryption password into agent config files. Instead, prefer setting MOODLE_CRED_PASSWORD as a process environment variable (and do not commit it to disk).
- There are clear mismatches to fix before trusting the skill: mcp_server.py currently uses a hard-coded password ('test-pass') rather than reading MOODLE_CRED_PASSWORD; batch_downloader.py references os.getenv but doesn't import os. These bugs can cause the server to run with incorrect credentials or leak prompts.
- SKILL.md and metadata disagree: the registry lists no required env vars but the runtime requires a password and a Moodle token in config.json. Verify which secrets the skill actually needs and whether you are comfortable supplying them.
- The MCP server exposes Moodle functions to any MCP-capable agent that you configure. Limit exposure by either (a) running the MCP server manually under your control, (b) using a dedicated account/token with minimal privileges, or (c) not adding the server to global agent configs.
- Playwright will download browser binaries and the code appears to drive an interactive Microsoft SSO flow (login.microsoftonline.com). If you plan automated runs, confirm the code's headless behavior and that MFA flows won't leak session data.
- License/author notes are inconsistent in SKILL.md (MIT header but a contributing instruction mentions GPLv3) — confirm licensing before reuse.
If you want, I can:
- Point to the exact lines to change so mcp_server reads MOODLE_CRED_PASSWORD from the environment and batch_downloader imports os.
- Produce a short secure deployment checklist (least-privilege token creation, run MCP server manually, avoid storing secrets in agent config).
Confidence: medium — the files are not obviously malicious, but the number of mismatches and insecure instructions meaningfully increase risk and warrant fixing/review before use.Like a lobster shell, security has layers — review code before you run it.
latestvk97fqfwdxka9r1m2p7k71s44ws84fzwp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.