Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed Islamic utility, but it has a serious shell-configuration execution weakness plus insecure handling of location/API data that users should review before installing.
Install only if you are comfortable reviewing and fixing shell scripts first. Avoid storing the Zakat API key in config.json, do not run scheduler setup unless you have inspected the CRON_ADD jobs, and prefer HTTPS-only API paths before using Quran or calendar features on untrusted networks.
lib/config.sh:25Arbitrary Command Execution Through Generated Shell Configuration
lib/zakat.sh:17Zakat API Key Exposed Through Process Arguments and Error Logs
lib/calendar.sh:27Plaintext HTTP Allows Interception and Tampering of Calendar and Quran Traffic
requirements.txt:1Unpinned Python Dependency Produces Non-Reproducible and Unverified Installations
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Generating job scheduling commands and system-event payloads introduces persistence and potential local operational side effects beyond a simple information utility. In context, the skill already warns users to review cron output, which reduces severity, but the top-level purpose still understates the risk of automation-related behavior.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
now = datetime.now()
today_str = now.strftime("%Y-%m-%d")
# We output instructions for the user/agent on what to schedule.
# In a real automated environment, the agent would parse this or we'd use a tool directly.
# The plan says to print CRON_ADD lines.
The README shows a fixed quran_language value of id, which suggests the skill is configured to use Indonesian by default. The document does not indicate that users can choose another language or that this locale restriction is optional, which may violate language/locale choice policy.
The skill documentation declares no explicit tool permissions even though the described behavior clearly requires shell execution, network access, environment variable access, and local file read/write. This weakens review boundaries and can lead an agent platform to grant broader capabilities than users expect, especially given features like cron generation, caching, and API-backed lookups.
The configuration sets quran_language to id, which establishes a specific language/locale preference in the skill documentation. Under the policy, forcing a specific language without offering user choice or making the constraint explicitly justified is a natural-language policy violation.
The quran_language field is hard-coded to id, which indicates a fixed language/locale choice in configuration. Because there is no accompanying indication of user selection, opt-in, or region-specific justification in this file, it appears to enforce a specific language and may violate the stated language/locale policy.
The helper prints the full failed-response body and URL to stderr after retry exhaustion. Failed API responses often contain sensitive data such as tokens, account details, request echoes, or internal error diagnostics, so unconditional logging can leak secrets into terminal history, CI logs, or centralized logging systems.
This code transmits user-supplied location information to an external third-party service, which is security-relevant because it shares potentially sensitive user location context outside the local environment. In this file, the risk is increased because the transmission occurs over HTTP rather than HTTPS, enabling both privacy leakage and response tampering in transit.
local enc_city=$(url_encode "$city")
local enc_country=$(url_encode "$country")
local url="http://api.aladhan.com/v1/calendarByCity?city=${enc_city}&country=${enc_country}&method=${CALCULATION_METHOD}&school=${CALCULATION_SCHOOL}&month=${month}&year=${year}"
local response=$(api_call "$url")
if [ $? -eq 0 ] && [ ! -z "$response" ]; then
The calendar API request is made over plain HTTP, which exposes user query data such as city, country, and timing preferences to interception or modification by anyone on the network path. Because the response influences prayer calendar output, an active attacker could tamper with returned timings and mislead users without detection.
The script reads zakat.api_key from config.json and writes it directly into config.bash, then later sources that generated file. This persists a secret in an additional plaintext artifact, increasing exposure through accidental commits, backups, loose file permissions, or other local disclosure paths; because the generated file is executable shell syntax, unescaped secret content could also create sourcing risk if the JSON helper does not safely sanitize values.
This code performs an outbound request to api.aladhan.com and embeds exact geographic coordinates in the URL query string. In the context of an Islamic prayer utility, the transmission is functionally related to the feature, but it still constitutes external disclosure of potentially sensitive location data to a third party and should be treated as a privacy-relevant vulnerability if not transparently handled.
fi
# Fetch from API
local url="https://api.aladhan.com/v1/timings/${today}?latitude=${LOCATION_LATITUDE}&longitude=${LOCATION_LONGITUDE}&method=${CALCULATION_METHOD}&school=${CALCULATION_SCHOOL}"
local response=$(api_call "$url")
if [ $? -eq 0 ] && [ ! -z "$response" ]; then
The function constructs a remote API request that includes precise latitude and longitude values, which are sensitive location data, and sends them to a third-party service without any user-facing notice or consent flow in this file. Even though HTTPS is used, this still exposes user location to an external provider and may create privacy and compliance risks if users are unaware of the transmission.
The manifest describes the skill as providing Islamic utilities for prayer times, fasting schedules, and Zakat calculations. This file instead implements a quote feature, including random quote retrieval from a remote quotes API and a scheduled daily quote automation flow, which is a separate user-facing capability not covered by that description.