Prayer Times Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.2

Overview

This skill mostly matches its prayer-time and journaling purpose, but it contains a real command-execution bug and stores sensitive personal data with incomplete privacy and permission clarity.

Review before installing. The skill stores your location, todos, journal entries, and reminder settings locally, and sends city data to Aladhan for prayer-time lookup. The package should be fixed before broad use because the todo completion command can execute unintended local commands through malformed input.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: run.sh:149

Finding

Arbitrary Command Execution Through GNU sed Program Injection

Content

View full analysis

Remediation

View remediation

"$TODOS_FILE.tmp" && mv -- "$TODOS_FILE.tmp" "$TODOS_FILE" ``` 4. Run the Skill as a dedicated, unprivileged account and avoid hardcoding storage under `/root`. 5. Apply restrictive permissions to the data directory and files, such as mode `0700` for the directory and `0600` for journal and configuration files. 6. Add regression tests using sed metacharacters, delimiters, newlines, and GNU sed flags to ensure all malformed identifiers are rejected. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior materially diverges from the declared purpose and implied permission model: it performs external network access and claims reminder functionality that is not accurately represented. Description-behavior mismatches are dangerous because they undermine user consent and security review, allowing hidden external communication or side effects to slip past policy checks.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · run.sh (reported line 124)May include surrounding context.

sh

;;
    
  "disable")
    rm -f "$DATA_DIR/reminder.json" 2>/dev/null
    echo "❌ Reminders disabled"
    ;;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly states that journal entries, todos, location, and reminder settings are stored persistently in local files, but it does not warn users that potentially sensitive religious practice, personal reflections, and location data will remain on disk. In this skill context, that increases privacy risk because users may assume these are ephemeral assistant interactions when they are actually retained across sessions and could be exposed to other local users, backups, or logs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises shell-based behavior and internet/file activity in documentation but does not declare an explicit tool scope or permissions boundary. This is dangerous because reviewers and the runtime may not have a clear, enforceable understanding of what the skill is allowed to do, increasing the chance of over-privileged execution or unnoticed capability creep.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger scope includes broad language like Islamic productivity, which can overlap with ordinary religious or self-improvement conversations unrelated to prayer times. Overbroad activation criteria are dangerous because they can cause the skill to engage unexpectedly, leading to unintended file writes, reminder state changes, or external API calls without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger for location-setting is vague enough to match casual statements about where the user is, rather than a deliberate command to change stored location. This can cause unintended persistence of location data and downstream changes in prayer-time calculations without meaningful confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reminder activation phrase is broad and may collide with generic reminder requests that the user did not intend for this skill. Because reminder settings are persistent local state and may later drive scheduled behavior, accidental activation creates unnecessary privacy and integrity risk.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation describes persistent writes to multiple local files for location, todos, journal, and reminders, but the manifest reportedly declares only internet access. This discrepancy is risky because it hides stateful local side effects from users and reviewers, which can enable unauthorized data retention or broader filesystem interactions than expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill transmits user-supplied location data to a third-party API over the network. While this is expected for fetching prayer times, it still creates a privacy and data-sharing risk because the user's city and usage timing are disclosed to an external service without any visible consent or minimization controls.

Content

Scanner excerpt · run.sh (reported line 55)May include surrounding context.

sh

# Build URL - handle Indonesia vs international
    if [ -n "$COUNTRY" ]; then
        URL="https://api.aladhan.com/timingsByCity/$DATE?city=$CITY&country=$COUNTRY&method=2"
    else
        URL="https://api.aladhan.com/timingsByCity/$DATE?city=$CITY&method=2"
    fi

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This is the same external transmission issue on the alternate URL construction path. User location is sent to api.aladhan.com, which may be appropriate for the feature but still represents third-party disclosure of user data and metadata.

Content

Scanner excerpt · run.sh (reported line 57)May include surrounding context.

sh

if [ -n "$COUNTRY" ]; then
        URL="https://api.aladhan.com/timingsByCity/$DATE?city=$CITY&country=$COUNTRY&method=2"
    else
        URL="https://api.aladhan.com/timingsByCity/$DATE?city=$CITY&method=2"
    fi
    
    # Call aladhan API

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · run.sh (reported line 109)May include surrounding context.

sh

;;
    
  "reminder"|"ingetin"|"enable")
    if command -v crontab &> /dev/null; then
        echo "✅ Prayer time reminders enabled! 🔔"
        echo ""
        echo "You'll receive notifications via Telegram:"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing text says reminders will be delivered via Telegram and at specific times, which describes an implemented notification capability. In reality, this branch only prints messages and saves a JSON file; there is no Telegram integration, scheduling setup, or message-sending logic in the script.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README states support for all major Indonesian cities and uses Indonesian-language invocation examples such as 'jadwal solat' and 'saya di bandung', while also fixing the prayer-time calculation method to ISNA. This may impose a locale/language expectation without clearly offering users a choice of language or regional convention.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The line "Security: No sensitive data stored, read-only API calls" suggests a largely side-effect-free design, but the document also describes persistent storage and reminder functionality that depends on cron and saved reminder settings. While the API usage itself may be read-only, the overall skill behavior is not purely read-only as documented.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This manifest description explains the skill's purpose but provides no explicit invocation phrases, constraints, or exclusion conditions. For manifest files, that can make activation scope ambiguous because it is unclear what user requests should or should not trigger the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The string 'Get times (multi-language)' indicates the skill intentionally uses multiple languages, but there is no visible option for the user to choose language or locale behavior. This can conflict with the policy against forcing language/locale behavior without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.