Ambil jadwal sholat (imsak, subuh, dzuhur, ashar, maghrib, isya) untuk kota/kabupaten di Indonesia dari API Muslim api.myquran.com (sumber Kemenag Bimas Islam). Gunakan saat user minta jadwal sholat hari ini / tanggal tertentu / 1 bulan untuk lokasi tertentu, atau butuh mencari ID kab/kota.

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:33 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it claims: fetch Indonesian prayer times from a clearly disclosed public API.

Before installing, understand that using this skill will contact api.myquran.com with the location and date or month you request. It does not appear to access private files, credentials, or persistent storage, but a stricter manifest should explicitly declare the network domain it uses.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly relies on outbound network access to query api.myquran.com, but no corresponding permission declaration is present. Missing permission metadata can bypass expected review and user awareness controls, increasing the risk of unintended external communication or future misuse if the skill is expanded.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.