ClawHub
Back to skill

Security audit

Imam

Security checks for vulnerabilities and agentic risk

Overview

This prayer-guidance skill is coherent and purpose-aligned, but users should configure its third-party TTS and optional audio fallback carefully.

Install only if you are comfortable configuring a cloud TTS provider and potentially sending generated prayer or sermon audio text to that provider. Prefer explicit invocation, review the optional gTTS fallback before using it, install audio tools from trusted sources, and avoid running fallback examples with elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/languages.md:64
Finding

Unpinned and Potentially Mismatched Third-Party Package Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/languages.md:54
Finding

Predictable Temporary Audio File Permits Symlink and Race Attacks

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code chunk only computes and prints prayer times using astronomical formulas and a few configurable calculation methods. It accepts latitude, longitude, timezone offset, and madhhab/method parameters, then returns Fajr, Sunrise, Dhuhr, Asr, Maghrib, and Isha times plus the current prayer. There is no audio output, speech synthesis, sermon generation or delivery, multilingual handling, user interaction flow, or any logic for leading prayers. While prayer time calculation could support an imam-related skill, this code's actual primary behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

  1. Set the environment variable in your OpenClaw workspace:
bash
# In your OpenClaw .env file
GOOGLE_APPLICATION_CREDENTIALS=/path/to/your-service-account.json
GOOGLE_TTS_LANGUAGE_CODE=ar-XA
GOOGLE_TTS_VOICE_NAME=ar-XA-Wavenet-B

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly routes generated or user-influenced religious text through external TTS providers, but it does not clearly warn users that their prompts, preferences, or recitations may be sent to third parties. This creates a privacy and data-sharing risk, particularly in a sensitive religious context where spoken content, language preferences, and timing/location-derived prayer data may reveal personal information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation phrases are broad enough to trigger during ordinary conversation, especially for common terms like prayer names or phrases such as 'Friday prayer' and 'time to pray.' In a voice-driven skill, unintended activation can cause surprise audio output, context switching, or transmission of spoken/user-supplied content to external services without clear intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Line L16 states the opening is 'Always in Arabic', which is a natural-language instruction enforcing a specific language. Under the policy, language constraints should either provide user opt-in or be clearly documented as a justified region-specific requirement; this file does not do so.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The text states that Arabic recitations are "ALWAYS in Arabic regardless of language setting," which imposes a fixed language behavior without user opt-in. Under the policy, forcing a specific language is a natural-language policy violation unless the constraint is explicitly offered as a choice or clearly justified as a documented exception.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented gTTS fallback uses os.system to invoke a local media player, which introduces shell execution into a skill whose purpose is prayer audio delivery. Even though the shown command is static, normalizing shell-based execution in documentation can lead implementers to extend it with user-controlled paths or commands, increasing command-injection and unsafe local execution risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The example explicitly states that audio 'plays immediately' and demonstrates local playback without a warning or consent step. Unexpected audio output is a real side effect that can disrupt users, reveal device activity, or create safety/privacy issues in shared or quiet environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The CLI defaults hard-code Pukhraayan, UP coordinates and IST (+5.5), which imposes a specific geographic/locale assumption on all users unless they override it. This is a natural-language policy concern because the user-facing help text and behavior effectively force a locale-specific default without offering an explicit opt-in or documenting why the restriction is necessary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.