Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward UK prayer-times helper that uses external location and prayer-time APIs, with privacy disclosures that could be clearer but no hidden persistence, credential use, or destructive behavior.
Before installing, be aware that using auto-detect contacts an IP geolocation service, and entering a location contacts an external geocoder before prayer times are fetched from Aladhan. Use a manually supplied broad city name if you prefer to avoid precise or IP-derived location sharing.
The skill requests or describes network-capable behavior, but the manifest does not clearly declare an enforceable tool scope such as allowed-tools/permissions in structured metadata. This creates ambiguity between what the skill says it needs and what the platform should permit, increasing the risk of unintended external requests or policy bypass through under-declared capabilities.
The skill advertises IP-based auto-detection, which can disclose approximate user location and IP-derived metadata to external services, but it does not present a clear, user-facing privacy warning or consent flow. In this context, the feature is functional rather than overtly malicious, but location-identifying data is sensitive enough that silent transmission meaningfully raises privacy risk.
The script automatically queries ipapi.co to derive the user's city, latitude, and longitude when no location is provided, but it does not clearly disclose that the user's network-derived location will be sent to a third-party service. This creates a privacy issue because users may not expect external location lookup, and the returned coordinates are then used in further external requests.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def get_prayer_times(lat, lon):
"""Fetch prayer times"""
try:
url = f"https://api.aladhan.com/v1/timings?latitude={lat}&longitude={lon}&method=2"
req = urllib.request.Request(url, headers={'User-Agent': 'UKPrayerTimes/1.0'})
with urllib.request.urlopen(req, timeout=10) as response:
data = json.loads(response.read())
User-entered location text is transmitted to OpenStreetMap Nominatim for geocoding without an explicit disclosure that the input leaves the local environment. While the data is less sensitive than precise auto-detected coordinates, it can still reveal a user's home area, mosque, or travel plans.
No suspicious patterns detected.