Imam

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:56 AM UTC
• Version: 0.1.1

Overview

This prayer-guidance skill is coherent and purpose-aligned, but users should configure its third-party TTS and optional audio fallback carefully.

Install only if you are comfortable configuring a cloud TTS provider and potentially sending generated prayer or sermon audio text to that provider. Prefer explicit invocation, review the optional gTTS fallback before using it, install audio tools from trusted sources, and avoid running fallback examples with elevated privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/languages.md:64
• Finding: Unpinned and Potentially Mismatched Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `references/languages.md:64-67` **Vulnerability Type**: Unsecured third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```python speak('Allahu Akbar') # plays audio immediately ``` ```text Install: `pip install gTTS mpg321` ``` ### Technical Analysis The fallback documentation instructs users to install `gTTS` and `mpg321` directly from the configured Python Package Index without specifying reviewed versions, package hashes, a lockfile, or a trusted repository. In addition, `mpg321` is presented elsewhere in the example as a command-line audio player, but the installation command treats it as a Python package. This package-name and package-manager mismatch creates a dependency-confusion or package-substitution risk. A Python package named `mpg321` is not necessarily the operating-system audio player expected by the example. Python packages may execute code during installation or when imported. Consequently, resolving an unintended, compromised, or attacker-controlled package could result in code execution under the account running the installation. ### Attack Path 1. A user enables the documented gTTS fallback. 2. The user follows the instruction `pip install gTTS mpg321`. 3. Pip resolves packages from the user's configured package index without enforcing a reviewed version or cryptographic hash. 4. An attacker-controlled, compromised, or unintended package is downloaded. 5. Package installation hooks or subsequently imported package code execute with the privileges of the user running pip. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the installing user. This may permit access to that user's files, environment variables, application credentials, and network resources. If the installation is run from an elevated shell or privileged environment, the impact could extend to system-level compromise. The project itself doe ...[truncated 127 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every Python dependency to a reviewed version and require hashes, for example through a locked requirements file used with `pip install --require-hashes`. 2. Use an explicitly trusted package index and review transitive dependencies. 3. Install the `mpg321` executable through the operating system's package manager rather than pip, because it is invoked as a system command. 4. Clearly separate Python package installation from system package installation in the documentation. 5. Prefer a maintained audio library or player with documented provenance. 6. Add automated dependency scanning and periodic review of pinned versions. 7. Recommend installation inside an isolated virtual environment without elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/languages.md:54
• Finding: Predictable Temporary Audio File Permits Symlink and Race Attacks<![CDATA[ ## Vulnerability Details **File Location**: `references/languages.md:54-63` **Vulnerability Type**: Predictable shared temporary file **Risk Level**: Medium ### Vulnerable Code ```python from gtts import gTTS import os def speak(text, lang='ar'): tts = gTTS(text=text, lang=lang, slow=True) tts.save('/tmp/imam_tts.mp3') os.system('mpg321 /tmp/imam_tts.mp3') # or: afplay / vlc speak('Allahu Akbar') # plays audio immediately ``` ### Technical Analysis The fallback example writes generated audio to the fixed path `/tmp/imam_tts.mp3`. `/tmp` is normally shared among local users, and the predictable filename is not created using an exclusive, securely randomized temporary-file operation. An attacker able to manipulate the shared temporary directory may pre-create the path as a symbolic link to another file writable by the victim. When `tts.save()` opens the predictable path, it may follow the link and overwrite or truncate the linked file. There is also a time-of-check/time-of-use opportunity between saving and playing the audio: an attacker may replace the file so that the player consumes attacker-selected content. The `os.system()` command shown here uses a static command and path, so this specific snippet does not expose user-controlled shell injection. The relevant flaw is the insecure temporary-file lifecycle. ### Attack Path 1. A local attacker predicts that the documented fallback will use `/tmp/imam_tts.mp3`. 2. Before execution, the attacker creates that path as a symbolic link to a file writable by the victim process, or repeatedly replaces the path during execution. 3. The victim invokes `speak()`. 4. `tts.save('/tmp/imam_tts.mp3')` follows the attacker-controlled filesystem object and writes to an unintended destination, or the attacker swaps the generated file before playback. 5. The victim's audio player opens the attacker-controlled replacement, or a victim-accessible file is overwritten. ### Impact Assessment The o ...[truncated 522 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a unique temporary file with Python's `tempfile` module rather than using a fixed `/tmp` path. 2. Ensure the file is created exclusively with restrictive permissions. 3. Keep the file descriptor under process control where supported, reducing opportunities for path replacement. 4. Invoke the player with an argument array rather than a shell. 5. Delete the temporary file in a `finally` block after playback. 6. Avoid elevated execution and select a private runtime directory where possible. A safer pattern is: ```python import os import subprocess import tempfile from gtts import gTTS def speak(text, lang="ar"): path = None try: with tempfile.NamedTemporaryFile( prefix="imam_tts_", suffix=".mp3", delete=False ) as audio: path = audio.name gTTS(text=text, lang=lang, slow=True).save(path) os.chmod(path, 0o600) subprocess.run(["mpg321", "--", path], check=True) finally: if path is not None: try: os.unlink(path) except FileNotFoundError: pass ``` The exact player arguments should be verified against the selected player's documented command-line interface. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code chunk only computes and prints prayer times using astronomical formulas and a few configurable calculation methods. It accepts latitude, longitude, timezone offset, and madhhab/method parameters, then returns Fajr, Sunrise, Dhuhr, Asr, Maghrib, and Isha times plus the current prayer. There is no audio output, speech synthesis, sermon generation or delivery, multilingual handling, user interaction flow, or any logic for leading prayers. While prayer time calculation could support an imam-related skill, this code's actual primary behavior is materially narrower and different from the declared purpose.

Credential Access

High

• Category: Privilege Escalation

Content

4. Set the environment variable in your OpenClaw workspace:

```bash
# In your OpenClaw .env file
GOOGLE_APPLICATION_CREDENTIALS=/path/to/your-service-account.json
GOOGLE_TTS_LANGUAGE_CODE=ar-XA
GOOGLE_TTS_VOICE_NAME=ar-XA-Wavenet-B

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly routes generated or user-influenced religious text through external TTS providers, but it does not clearly warn users that their prompts, preferences, or recitations may be sent to third parties. This creates a privacy and data-sharing risk, particularly in a sensitive religious context where spoken content, language preferences, and timing/location-derived prayer data may reveal personal information.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation phrases are broad enough to trigger during ordinary conversation, especially for common terms like prayer names or phrases such as 'Friday prayer' and 'time to pray.' In a voice-driven skill, unintended activation can cause surprise audio output, context switching, or transmission of spoken/user-supplied content to external services without clear intent.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: Line L16 states the opening is 'Always in Arabic', which is a natural-language instruction enforcing a specific language. Under the policy, language constraints should either provide user opt-in or be clearly documented as a justified region-specific requirement; this file does not do so.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The text states that Arabic recitations are "ALWAYS in Arabic regardless of language setting," which imposes a fixed language behavior without user opt-in. Under the policy, forcing a specific language is a natural-language policy violation unless the constraint is explicitly offered as a choice or clearly justified as a documented exception.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documented gTTS fallback uses os.system to invoke a local media player, which introduces shell execution into a skill whose purpose is prayer audio delivery. Even though the shown command is static, normalizing shell-based execution in documentation can lead implementers to extend it with user-controlled paths or commands, increasing command-injection and unsafe local execution risk.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The example explicitly states that audio 'plays immediately' and demonstrates local playback without a warning or consent step. Unexpected audio output is a real side effect that can disrupt users, reveal device activity, or create safety/privacy issues in shared or quiet environments.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The CLI defaults hard-code Pukhraayan, UP coordinates and IST (+5.5), which imposes a specific geographic/locale assumption on all users unless they override it. This is a natural-language policy concern because the user-facing help text and behavior effectively force a locale-specific default without offering an explicit opt-in or documenting why the restriction is necessary.

Static analysis

No suspicious patterns detected.