Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Prayer Times - Automated Salat Reminders
v0.1.0Get accurate Islamic prayer times (Fajr, Dhuhr, Asr, Maghrib, Isha) for any location worldwide using official calculation methods. Use when users ask about prayer times, Salat schedules, next prayer, or need to set up automated prayer reminders. Includes automated background reminder system that alerts users 10 minutes before, at prayer time, and 5 minutes after - even during conversations. Supports 20+ country-specific calculation methods including Morocco, Saudi Arabia, Egypt, Turkey, UAE, and more.
⭐ 0· 828·1 current·1 all-time
by@diepox
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Code and docs align with the stated purpose (fetching prayer times from api.aladhan.com and scheduling reminders). However, ancillary instructions to push the repo to a specific external GitHub account (diepox) and pre-baked git remotes are not necessary for runtime reminders and look unrelated to core functionality.
Instruction Scope
SKILL.md and CRITICAL_SETUP.md instruct the agent to perform system-level actions: verify cron jobs at every session start, recreate missing cron jobs automatically ("don't wait, don't ask"), and run commands in system paths (/root/.openclaw/workspace). That grants broad discretion to modify system configuration and run commands beyond simply fetching times and sending reminders.
Install Mechanism
There is no formal install spec (instruction-only behavior) which limits automatic code installation risk. The docs do include optional instructions to install Cloudflare WARP (system-level VPN install requiring sudo) — plausible for connectivity issues but carries elevated privileges if executed.
Credentials
The skill declares no environment variables, no credentials, and does not request unrelated secrets. Network access to api.aladhan.com is expected and the scripts only contact that API (no hidden remote endpoints in the code itself).
Persistence & Privilege
The skill expects persistent cron jobs and explicitly directs agents to verify and recreate them at session startup without prompting. While persistent scheduling is required for reminders, the explicit requirement to auto-recreate system cron jobs and to run checks "before doing ANYTHING else" increases the skill's control over the host/agent environment and could be abused if the skill or its instructions are malicious.
What to consider before installing
This skill's core functionality (calling the AlAdhan API and computing reminders) is coherent and the code is readable. However, before installing: 1) Review the scripts yourself and run them in a safe/test environment first — don't blindly allow the agent to edit cron jobs. 2) Do not run push-to-github.sh or follow the GitHub setup steps unless you intend to publish the code to the listed external account; change the remote to your own repository if you want to push. 3) If you want automated reminders, configure cron jobs yourself (copy the provided job definitions) and avoid granting the agent unconditional permission to recreate system cron entries at session start. 4) Be cautious about running the VPN install commands (they require sudo). If you are not comfortable with the agent modifying cron or system settings, use the scripts manually or run them under user control rather than enabling automatic session-start recovery.Like a lobster shell, security has layers — review code before you run it.
automationvk97c1636m367j75fzk964nb5m180wfjnislamvk97c1636m367j75fzk964nb5m180wfjnlatestvk97c1636m367j75fzk964nb5m180wfjnmuslimvk97c1636m367j75fzk964nb5m180wfjnprayervk97c1636m367j75fzk964nb5m180wfjnreligiousvk97c1636m367j75fzk964nb5m180wfjnremindersvk97c1636m367j75fzk964nb5m180wfjnsalatvk97c1636m367j75fzk964nb5m180wfjnworldwidevk97c1636m367j75fzk964nb5m180wfjn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.