📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills moodle-external-api-development
📦
moodle-external-api-development
Content revision r2 High Risk ⚡ Contains scripts⚙️ External commands🌐 Network access
Build Secure Moodle External APIs
Custom Moodle web services are easy to expose incorrectly or structure inconsistently. This skill provides patterns for parameters, permissions, registration, database access, testing, and troubleshooting.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "moodle-external-api-development" from https://skillstore.io/skills/sickn33-moodle-external-api-development.md and its manifest at https://skillstore.io/api/skills/sickn33-moodle-external-api-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "moodle-external-api-development". Create a read endpoint for course progress.
Expected outcome:
A file-by-file implementation outline with parameter definitions, course context checks, required capabilities, response fields, and service registration.
Using "moodle-external-api-development". Review a quiz-attempt endpoint for security.
Expected outcome:
A prioritized review identifying missing authorization, unsafe diagnostics, query concerns, and focused remediation steps.
Using "moodle-external-api-development". Plan testing for a Moodle write service.
Expected outcome:
A test matrix covering roles, invalid parameters, denied access, transaction rollback, duplicate requests, and return-schema validation.
Security Audit
High Riskv5 • 8/4/2026 Open versioned report
All 109 static findings are false positives caused by Markdown syntax, fixed Moodle examples, placeholder endpoints, or official documentation links. Semantic review found a high-severity authorization omission plus medium-severity logging and credential-handling risks in the guidance.
1
Files scanned
606
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Read Endpoint Omits Authorization Checks
The final quiz-attempt endpoint accepts arbitrary user and course identifiers but does not validate context or require a capability before reading records.
The complete method body validates parameter shape only, then queries another user by supplied identifiers without any context or capability check.
Medium
Sensitive Debug Data Written to Permissive Logs
The logging example creates a world-writable directory and records identifiers, SQL, exception messages, and stack traces, increasing disclosure and tampering risk.
The example explicitly uses mode 0777 and writes request identifiers, the last SQL statement, exception details, and full stack traces.
Medium
Credentials Exposed Through Command Arguments
The curl examples place an administrator password and web-service token in command arguments, which can remain in shell history or process listings.
The examples pass password and token values through repeated command-line data arguments, a known local credential exposure path.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (50)
SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:33 SKILL.md:35-52 SKILL.md:52-55 SKILL.md:55-56 SKILL.md:56 SKILL.md:57-62 SKILL.md:62-73 SKILL.md:73-76 SKILL.md:76-77 SKILL.md:77-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-81 SKILL.md:81-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-89 SKILL.md:89-90 SKILL.md:90-91 SKILL.md:91-95 SKILL.md:95-144 SKILL.md:144-147 SKILL.md:147-148 SKILL.md:148-149 SKILL.md:149-155 SKILL.md:155-168 SKILL.md:168-171 SKILL.md:171-178 SKILL.md:178-180 SKILL.md:180-206 SKILL.md:206-209 SKILL.md:209-210 SKILL.md:210-211 SKILL.md:211-212 SKILL.md:212-213 SKILL.md:213-214 SKILL.md:214-218 SKILL.md:218-262 SKILL.md:262-275 SKILL.md:275-292 SKILL.md:292-296 SKILL.md:296-320 SKILL.md:320-324 SKILL.md:324-362 SKILL.md:362-366 SKILL.md:366-390 SKILL.md:390-403
🌐 Network access (6)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-moodle-external-api-development/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-moodle-external-api-development?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-moodle-external-api-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-moodle-external-api-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-moodle-external-api-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). moodle-external-api-development security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-moodle-external-api-development/audits/5BibTeX citation
@techreport{sickn33-sickn33-moodle-external-api-development-2026,
author = {sickn33},
title = {moodle-external-api-development security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-moodle-external-api-development/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "moodle-external-api-development security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-08-04"
url: "https://skillstore.io/skills/sickn33-moodle-external-api-development/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-moodle-external-api-development:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Create a Plugin Endpoint
Draft a Moodle external function with validated parameters, permissions, return definitions, and service registration.
Review an Existing Service
Check an endpoint for framework structure, database safety, permission enforcement, and response consistency.
Connect an External Client
Plan REST or AJAX access, token usage, testing steps, and expected Moodle configuration.
Try These Prompts
Draft a Read Endpoint
Create a read-only Moodle endpoint for [resource]. Include parameter definitions, context validation, capability checks, return structure, and service registration.
Review Endpoint Security
Review this Moodle endpoint for validation, context, capabilities, SQL safety, return accuracy, and information disclosure. Explain each required change.
Design a Write Workflow
Design a transactional Moodle API that creates [activity]. Include rollback behavior, capability checks, idempotency decisions, and tests.
Threat Model API Exposure
Compare REST and AJAX exposure for this Moodle function. Cover tokens, authorization, sensitive logging, rate limits, and failure responses.
Best Practices
- Validate parameters, context, and capabilities inside every endpoint.
- Use parameterized Moodle database methods and short transactions.
- Test authorized and unauthorized roles with production-safe logging enabled.
Avoid
- Do not trust a user identifier merely because it passed type validation.
- Do not log tokens, full SQL statements, or stack traces in production.
- Do not expose write functions without explicit capabilities and rollback tests.
Frequently Asked Questions
Does this skill generate a complete Moodle plugin?
It provides implementation patterns and file guidance, but plugin metadata, language strings, capabilities, and tests still require project-specific work.
Which Moodle API methods are covered?
It covers execute_parameters, execute, execute_returns, service registration, database access, transactions, REST testing, and AJAX calls.
Does it support both read and write endpoints?
Yes. It explains read and write registration and includes transaction and course activity patterns for write operations.
Are the examples ready for production?
No. Adapt them to your Moodle version and add complete authorization, secure logging, credential protection, and automated tests.
Can it test my Moodle installation?
No. It provides test procedures and review guidance but cannot access or validate a live installation by itself.
How should API permissions be enforced?
Validate the relevant context and require specific capabilities inside each function before reading or changing protected data.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
81e05e636292629114b76cbb3922fbe57672fc02
Maintenance freshness
8/5/2026
Usage
6 downloads · 231 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
wp-abilities-api
74Build WordPress Abilities API Integrations
by Automattic
WordPress abilities can fail because of registration order, metadata, permissions, or REST configuration. This skill provides focused implementation and troubleshooting guidance.
Coding & Development View
📦
wp-plugin-development
81Build Secure WordPress Plugins
by Automattic
WordPress plugin changes can introduce lifecycle, data, and security defects. This skill provides a structured workflow for implementation, review, testing, and release preparation.
Coding & Development View
📦
wp-block-development
81Build and Maintain WordPress Blocks
by Automattic
WordPress block changes can break registration, saved content, or editor behavior. This skill guides implementation, migration, debugging, and verification for Gutenberg blocks.
Coding & Development View
📦
api-design
80Design Better REST and GraphQL APIs
by supercent-io
API teams need consistent contracts before implementation starts. This skill guides resource design, request formats, errors, versioning, and documentation.
Coding & Development View
📦
http-api-cloudbase
80Build CloudBase HTTP API Clients
by tencentcloudbase
CloudBase teams need reliable raw HTTP integrations when SDKs are unavailable. This skill guides endpoint selection, authentication, OpenAPI lookup, and safe request construction.
Coding & Development View
📦
woocommerce-dev-cycle
79Streamline WooCommerce Development Checks
by woocommerce
WooCommerce contributors need project-specific commands for testing and code quality. This skill provides focused workflows for tests, linting, formatting, and troubleshooting.
Coding & Development View