Moodle Connector Skill

Moodle REST API client, batch downloader, and MCP server for Claude Code integration

What to check before installing or enabling this skill: - Do not blindly paste your encryption password into agent config files. Instead, prefer setting MOODLE_CRED_PASSWORD as a process environment variable (and do not commit it to disk). - There are clear mismatches to fix before trusting the skill: mcp_server.py currently uses a hard-coded password ('test-pass') rather than reading MOODLE_CRED_PASSWORD; batch_downloader.py references os.getenv but doesn't import os. These bugs can cause the server to run with incorrect credentials or leak prompts. - SKILL.md and metadata disagree: the registry lists no required env vars but the runtime requires a password and a Moodle token in config.json. Verify which secrets the skill actually needs and whether you are comfortable supplying them. - The MCP server exposes Moodle functions to any MCP-capable agent that you configure. Limit exposure by either (a) running the MCP server manually under your control, (b) using a dedicated account/token with minimal privileges, or (c) not adding the server to global agent configs. - Playwright will download browser binaries and the code appears to drive an interactive Microsoft SSO flow (login.microsoftonline.com). If you plan automated runs, confirm the code's headless behavior and that MFA flows won't leak session data. - License/author notes are inconsistent in SKILL.md (MIT header but a contributing instruction mentions GPLv3) — confirm licensing before reuse. If you want, I can: - Point to the exact lines to change so mcp_server reads MOODLE_CRED_PASSWORD from the environment and batch_downloader imports os. - Produce a short secure deployment checklist (least-privilege token creation, run MCP server manually, avoid storing secrets in agent config). Confidence: medium — the files are not obviously malicious, but the number of mismatches and insecure instructions meaningfully increase risk and warrant fixing/review before use.

Type: OpenClaw Skill Name: moodle-connector-skill Version: 1.0.0 The Moodle Connector skill is a legitimate tool for interacting with Moodle LMS instances, providing features like course listing, grade tracking, and file downloading. It uses standard security practices such as PBKDF2 and Fernet for local credential encryption and Playwright for handling Microsoft SSO/MFA. No evidence of malicious intent, data exfiltration, or prompt injection was found; the code's behavior is consistent with its documented purpose.