ClawHub
Back to skill

Security audit

Jadwal Sholat

Security checks across malware telemetry and agentic risk

Overview

This skill appears to only fetch Indonesian prayer schedules from the documented MyQuran API, with no evidence of hidden access, persistence, credential use, or destructive behavior.

Before installing, be aware that location search terms or prayer schedule parameters are sent to api.myquran.com over HTTPS. This is expected for the skill, but users who do not want location-related queries leaving their environment should avoid using it or provide only coarse city-level input.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly instructs use of an external API and helper script that performs network access, but the skill metadata does not declare corresponding permissions or capabilities. Undeclared network use weakens transparency and policy enforcement, making it harder for reviewers and users to understand what data leaves the environment.

External Transmission

Medium
Category
Data Exfiltration
Content
# Jadwal Sholat (api.myquran.com)

API base: `https://api.myquran.com/v3`

Script helper (rekomendasi): `scripts/myquran_sholat.py`
Confidence
86% confidence
Finding
https://api.myquran.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.