Prayer Times - Automated Salat Reminders

WarnAudited by ClawScan on May 10, 2026.

Overview

The prayer-time lookup code is mostly purpose-aligned, but the skill pushes persistent background jobs and global agent instructions that can override normal user control and recreate reminders without asking.

Install only if you explicitly want always-on prayer reminders. Before enabling setup, confirm the cron jobs, cost, notification channel, and disable/remove process. Avoid adding the AGENTS.md “before anything else” instructions unless you truly want the agent to prioritize and repair this reminder system across future sessions.

Findings (7)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may interrupt or delay unrelated tasks and may recreate reminder jobs even if the user did not want them restored.

Why it was flagged

This tells the agent to reorder all future work around this skill and to take recovery actions without asking the user, which can override the user's current intent.

Skill content
Before doing ANYTHING else, verify prayer reminder system is active: ... If missing, recreate immediately - don't wait, don't ask
Recommendation

Make session checks opt-in, require explicit user confirmation before recreating jobs, and avoid global instructions that supersede the user's current request.

What this means

Background reminders could keep returning after deletion or continue consuming resources unless the user clearly disables both the cron jobs and any persistent instructions.

Why it was flagged

The skill documents self-recovery behavior for persistent scheduled jobs, including recreating missing jobs, which can preserve its background operation beyond the user's immediate request.

Skill content
The agent should: 1. Recreate missing cron jobs 2. Fetch prayer times if file is missing 3. Test the system
Recommendation

Treat deletion or absence of a job as a user-controlled state unless the user explicitly asks for recovery; provide a clear uninstall/disable procedure.

What this means

Future conversations could inherit this priority rule and repeatedly check or repair the reminder system even when the user is working on unrelated tasks.

Why it was flagged

The artifact recommends adding persistent instructions to AGENTS.md, meaning the behavior can be reused across future sessions and tasks rather than only when the skill is invoked.

Skill content
Add this to your `AGENTS.md`: ... **🕌 SALAT FIRST - CRITICAL CHECK** ... Before doing ANYTHING else
Recommendation

Do not install global AGENTS.md instructions by default; if offered, make them narrowly scoped, easy to remove, and clearly approved by the user.

What this means

A user may feel pressured to allow always-on jobs or global instructions without fully considering interruptions, token cost, or how to disable them.

Why it was flagged

The wording uses strong urgency and moral pressure around setup reliability, which can push users or agents toward accepting persistent automation without carefully reviewing control and cost tradeoffs.

Skill content
Prayer is not optional. The reminder system must be 100% reliable. ... Don't skip this. Missing a prayer reminder is a critical failure.
Recommendation

Use neutral setup language, clearly separate religious reminder value from system-control choices, and emphasize user consent and reversibility.

What this means

The reminders can consume tokens/resources and send messages into active sessions on a schedule.

Why it was flagged

The skill uses scheduled agent turns to run local Python commands every five minutes; this is aligned with automated reminders but is still recurring autonomous tool use.

Skill content
"kind": "every", "everyMs": 300000 ... "payload": { "kind": "agentTurn", "message": "Check if it's time for Salat reminder... Run: cd /root/.openclaw/workspace && python3 skills/prayer-times/scripts/check_prayer_reminder.py ..." }
Recommendation

Only enable the cron jobs after explicit user approval, show the expected cost/frequency, and provide simple disable/remove commands.

What this means

The external API can receive the location used for prayer-time lookup.

Why it was flagged

The script sends the user's chosen city/country or coordinates to the external AlAdhan API, which is disclosed and necessary for the feature but still shares location information with a provider.

Skill content
url = f"https://api.aladhan.com/v1/timingsByCity/{date}" ... params = { "city": city, "country": country, "method": method } ... requests.get(url, params=params, timeout=15)
Recommendation

Tell users that location queries go to api.aladhan.com and let them choose city-level input instead of precise coordinates when privacy matters.

What this means

Users who follow the optional setup may install or trust external software outside the reviewed registry artifact.

Why it was flagged

The docs include user-directed external clone and optional sudo package-repository setup steps, while the registry metadata lists no install spec or required binaries.

Skill content
git clone https://github.com/diepox/openclaw-prayer-times.git ... curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor ... sudo apt update && sudo apt install cloudflare-warp
Recommendation

Prefer registry installation, pin external sources where possible, and treat Cloudflare WARP setup as an optional network workaround requiring separate review.