Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Indonesian prayer-time lookup skill that contacts the disclosed MyQuran API and shows no hidden persistence, credential access, or destructive behavior.
Before installing, understand that city/location keywords, location IDs, dates/months, and timezone values you query may be sent to api.myquran.com. The skill is Indonesian-focused, and the monthly helper currently displays only a 7-day preview rather than a full month.
The skill clearly relies on outbound network access to query a third-party API, but it does not declare any explicit tool scope or permissions. This creates a governance and least-privilege gap: consumers of the skill cannot easily see that external network access is required, which can lead to unintended data transmission or policy bypass in stricter environments.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
The manifest says the skill can provide jadwal sholat for '1 bulan', implying a full monthly schedule. However, the monthly command explicitly limits output to the first 7 days and labels it as a preview, so the implemented behavior is narrower than the stated capability.
The module docstring and command descriptions are written entirely in Indonesian, and user-facing messages throughout the script also appear only in Indonesian. The policy allows locale constraints when they are explicitly justified, but this file does not state that the skill is intentionally limited to Indonesian-speaking users or offer any language opt-in.
The docstring advertises commands 'id-tanggal' and 'id-bulan', but the parser only implements a single 'id-period' subcommand. This is an active documentation-to-code mismatch that can mislead callers about the interface and supported operations.
No suspicious patterns detected.