Islamic Reflection
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears benign, but it runs an included Python script and contacts a calendar API to get the Hijri date.
This looks safe for normal use if you are comfortable with local Python execution and an outbound calendar API request. The script does not show file access, persistence, credentials, or data-changing behavior.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Asking for a reflection will run the included Python script and return its printed output.
The skill makes local script execution part of the normal workflow. The command is fixed, disclosed, and purpose-aligned, so this is a notice rather than a concern.
When user requests a reflection, you MUST execute the Python script: `python scripts/reflection.py`
Review the included script before installing and avoid running modified or untrusted replacement scripts.
The skill may not work unless Python is available in the environment.
The registry metadata omits the Python runtime even though SKILL.md directs the agent to run `python scripts/reflection.py`; this is an under-declared runtime requirement, not hidden behavior.
Required binaries (all must exist): none
Ensure Python is installed and that the agent runs only the included script.
Running the skill will make an outbound request to api.aladhan.com.
The script contacts an external calendar API to convert the current Gregorian date to a Hijri date. It sends the date and normal network metadata, with no user content or credentials shown.
url = f"https://api.aladhan.com/v1/gToH/{today.day:02d}-{today.month:02d}-{today.year}"Install only if you are comfortable with that date lookup, or use/block network access if offline behavior is required.