Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it claims, but it quietly contacts a third-party API when users may expect a local reflection script.
Review before installing. This skill runs a local Python script and contacts api.aladhan.com to convert the current date to a Hijri date. Install only if you are comfortable with that third-party request and the broad trigger behavior; a safer version would disclose the API use, narrow triggers to explicit Islamic reflection requests, and provide an offline Hijri-date fallback.
The skill description claims a narrow, deterministic reflection generator, but static analysis indicates undeclared external network access and incomplete implementation of advertised calendar behavior. Hidden network dependency is dangerous because it expands the trust boundary, introduces privacy/integrity risks from third-party responses, and misleads reviewers and users about what executes.
The skill instructs execution of a Python script but declares no tool scope or permissions, while the associated behavior reportedly includes network access. This creates a transparency and policy gap: a caller may believe the skill is local-only spiritual content, but it can reach external services and potentially exfiltrate metadata or fetch untrusted content.
The instructions require a specific religious framing and exact script output for all matched requests, without checking whether the user explicitly wants religious guidance in that form. In isolation this is more of an appropriateness and consent issue, but combined with mandatory script execution it can force tool use and prescribed content where a simple conversational response or clarification would be safer.
The trigger examples are broad enough that common phrases like 'inspire me' or 'motivate me islamically' could invoke the skill unexpectedly. Unintended invocation is risky here because the skill mandates code execution, so a loose match may cause script runs in contexts where the user did not clearly request this specific functionality.
The file's title, printed output, and reflection text are written entirely from a specifically Islamic devotional perspective and present directives such as prayer and dua as assumed user context. Under the stated policy, forcing a particular language/locale or analogous user-facing preference without opt-in should be flagged when no choice mechanism or justification is present.
The script is presented as a local reflection generator, but it makes a live request to a third-party API to compute Hijri dates. Even though the transmitted data is limited and not highly sensitive, this creates undisclosed external dependency, metadata leakage (IP address, access timing, user agent), and behavior that may surprise users or violate sandbox/offline expectations.
The code transmits a request to an external domain, introducing third-party communication from a script that otherwise appears local. In this context the payload is small and not directly sensitive, but any unsolicited outbound connection expands the trust boundary and can leak operational metadata or fail unpredictably based on network conditions and service trustworthiness.
"""Fetch actual Hijri date from Aladhan API"""
try:
today = datetime.now()
url = f"https://api.aladhan.com/v1/gToH/{today.day:02d}-{today.month:02d}-{today.year}"
req = urllib.request.Request(url, headers={'User-Agent': 'IslamicReflection/1.0'})
with urllib.request.urlopen(req, timeout=10) as response:
The code performs a third-party network request without any user-facing notice in the script output or apparent opt-in flow. This is primarily a transparency and privacy issue: users may not realize that running a devotional/local utility reveals their IP address and usage timing to an external service.
No suspicious patterns detected.