Laylatul Qadr Guide

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:17 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent Ramadan worship-planning guide, with some privacy and trigger-scope caveats but no evidence of exfiltration, destructive behavior, or hidden privileged actions.

Install this if you want an Islamic Ramadan and Laylatul Qadr planning assistant. Be aware it may activate for broad Ramadan discussions, its generated HTML checklist can save progress locally in your browser, and opening the template online may contact Google Fonts unless fonts are made local or network access is blocked.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: templates/dua-book-template.html:8
• Finding: Remote Google Fonts Dependency Causes Metadata Disclosure and Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `templates/dua-book-template.html:8` **Vulnerability Type**: Remote third-party stylesheet dependency **Risk Level**: Low ### Vulnerable Code ```css @import url('https://fonts.googleapis.com/css2?family=Amiri:wght@400;700&family=Inter:wght@300;400;600;700&display=swap'); ``` ### Technical Analysis The HTML template imports a stylesheet from Google Fonts whenever the generated document is opened with network access. This creates an external dependency whose response and availability are outside the project's control. The request discloses network metadata to third-party infrastructure, including the user's IP address, user agent, request time, and potentially referrer information depending on browser policy. The browser may subsequently request font resources referenced by the returned stylesheet. Although the imported resource is CSS rather than directly executable JavaScript, remote stylesheets remain active browser content and can change after the skill package has been audited. This conflicts with the project's privacy-conscious and offline/printable design claims. No evidence was found that personal dua text, form contents, credentials, or local files are explicitly transmitted by the project code. ### Attack Path 1. The skill generates or distributes a dua book using `templates/dua-book-template.html`. 2. A user opens the generated HTML document in a browser while connected to the Internet. 3. The browser automatically requests the stylesheet from `fonts.googleapis.com`. 4. Google-controlled infrastructure receives the user's network and browser metadata. 5. The returned stylesheet directs the browser to retrieve associated font resources. 6. If the remote service, delivery path, or referenced content were compromised or changed, the rendered document would consume the modified remote content without local integrity verification. No user interaction beyond opening the HTML file is required fo ...[truncated 652 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Download and package the required Amiri and Inter font files with the project. 2. Replace the remote `@import` declaration with local `@font-face` declarations, for example: ```css @font-face { font-family: 'Amiri'; src: url('./fonts/amiri-regular.woff2') format('woff2'); font-weight: 400; font-style: normal; font-display: swap; } @font-face { font-family: 'Inter'; src: url('./fonts/inter-regular.woff2') format('woff2'); font-weight: 400; font-style: normal; font-display: swap; } ``` 3. Alternatively, remove the external dependency and use system font stacks. 4. Add a restrictive Content Security Policy to generated HTML, such as: ```html <meta http-equiv="Content-Security-Policy" content="default-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'none'; img-src 'self' data:;"> ``` 5. If remote fonts must remain, disclose the outbound request to users and configure an appropriate referrer policy. Self-hosting is preferable because Subresource Integrity is not straightforward for a dynamically generated Google Fonts stylesheet. 6. Test the completed artifact with network access disabled and verify that it remains fully functional and visually acceptable. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README states the skill will 'automatically trigger for Ramadan-related queries,' while the metadata also describes a wide range of activation phrases and contexts. Broad automatic invocation can cause the skill to activate when users did not explicitly request religious guidance, increasing the chance of unwanted context capture, inappropriate intervention, or overshadowing other more relevant skills.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description casts a very wide net over Ramadan-related topics, including general preparation, schedules, family balance, and personalized planning. This can cause unintended invocation outside the user's actual intent, leading to oversharing of sensitive religious/lifestyle guidance, reduced user autonomy, and incorrect routing when a more appropriate general assistant or specialist should respond.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The instruction that the skill should trigger proactively during Ramadan season is insufficiently bounded by user intent, timing, or context. A proactive trigger can surface the skill when the user is discussing Ramadan only tangentially, increasing the chance of unsolicited guidance, privacy-invasive personalization, and inappropriate workflow takeover by the skill.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: Line L485 states 'The behavioral change must come first - then Allah's grace amplifies it' as a universal directive. This enforces a specific faith-based framing in natural language without indicating that the guidance is only for users who explicitly want Islamic devotional content.

Session Persistence

Medium

• Category: Rogue Agent

Content

localStorage.setItem(this.id, this.checked);
            });
            
            // Load saved state
            const saved = localStorage.getItem(checkbox.id);
            if (saved === 'true') checkbox.checked = true;
        });

• Confidence: 82% confidence
• Finding: The code restores saved checkbox state from localStorage, creating session-to-session persistence of user interaction data. In this skill's context, the persisted data reflects religious observance habits, which makes the privacy sensitivity somewhat higher even though the mechanism itself is simple and local to the browser.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The language support section states 'Currently: English with Arabic duas' without indicating that users can choose another language or opt in to this constraint. This can be read as forcing a specific language/locale, which may conflict with organizational language-choice expectations absent justification or user choice.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The template stores a user's devotional checklist state in browser localStorage, which creates persistent client-side tracking of religious practice activity. While the data is not highly sensitive by itself and no exfiltration is present, storing faith-related behavioral data is privacy-relevant and exceeds what is strictly necessary for rendering a static dua book.

Static analysis

No suspicious patterns detected.