Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Indonesian prayer-time lookup tool that sends location/date requests to api.myquran.com and does not show hidden persistence, credential access, or destructive behavior.
Install only if you are comfortable sending Indonesian location keywords or location IDs, requested dates/months, and timezone values to api.myquran.com. Expect Indonesian output and note that monthly results are currently a 7-day preview rather than a full month in the helper script.
The skill clearly relies on outbound network access to query api.myquran.com, but the manifest does not declare any tool scope such as allowed-tools or permissions. This is a real security hygiene issue because it weakens least-privilege controls and makes the skill's external communication capabilities implicit rather than explicit.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.request
from typing import Any, Dict, List, Optional, Tuple
API_BASE = "https://api.myquran.com/v3"
DEFAULT_TZ = "Asia/Jakarta"
All user-facing natural-language strings in the docstring and command output are in Indonesian, and the tool does not provide an opt-in or alternative language selection. The policy requires flagging language or locale constraints when they are forced without user choice or explicit justification.
The top-level docstring lists id-bulan <id> <YYYY-MM> as a supported command, but the parser actually defines id-period and never registers id-bulan. This is an active documentation-to-code contradiction, not just an omitted detail.
This code sends user-provided keyword and timezone values to an external API using HTTP requests, but the CLI help and printed output do not disclose that entered data will be transmitted off-system. For a code file, outbound network transmission of user data should have some visible warning, confirmation, or clear disclosure unless it is explicitly communicated as part of the interface.
The manifest description explicitly says the skill should be used when the user requests a 1-month prayer schedule for a location. In code, cmd_bulan fetches monthly data but intentionally prints only the first 7 days (keys[:7]) and even labels it as a preview, so the implemented behavior is narrower than the claimed capability.
No suspicious patterns detected.