Prayer Times Id
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: prayer-times-id Version: 1.0.3 The skill is classified as benign. It adheres to its stated purpose of scheduling prayer time reminders using the AlAdhan API. The `engine.js` code demonstrates good security practices, including the use of `execFileSync` with an array of arguments to prevent shell injection, robust input validation for configuration parameters, and explicit sanitization of the `location.name` input. Network requests are limited to the documented `api.aladhan.com` endpoints, and there is no evidence of data exfiltration, persistence mechanisms, or obfuscation. The `SKILL.md` documentation is descriptive and does not contain any prompt injection attempts against the OpenClaw agent.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill normally will add reminder jobs to OpenClaw; running with --dry-run will only simulate the output.
The skill invokes the OpenClaw CLI to add cron system events. This matches the stated purpose and avoids shell string interpolation, but it is still local command execution that can modify the user's OpenClaw schedule.
return execFileSync('openclaw', args, { ... }); ... 'cron', 'add', '--name', name, '--at', whenIso, '--system-event', message, '--delete-after-run', '--json'Use --dry-run first, then run normally only if you want OpenClaw cron reminders added for the remaining prayer times today.
The external prayer-time provider will receive the configured coordinates and calculation method.
The configured latitude and longitude are sent to the external AlAdhan API to calculate prayer times. This is disclosed and purpose-aligned, but location data can be sensitive.
const timingsUrl = `https://api.aladhan.com/v1/timings?${queryParams.join('&')}`; ... `latitude=${encodeURIComponent(latitude)}` ... `longitude=${encodeURIComponent(longitude)}`Only configure a location you are comfortable sharing with AlAdhan, and review the API dependency if you need stricter privacy.
Reminder events may appear later even after the script has exited, until each one-shot job runs and deletes itself.
The skill creates scheduled system-event jobs that persist until they fire, but it uses delete-after-run and only schedules the prayer times that have not yet passed for the current day.
'--at', whenIso, '--system-event', message, '--delete-after-run'
Review your OpenClaw cron list if you want to confirm or remove scheduled reminders.
The skill may fail or behave differently if Node.js or the expected OpenClaw CLI is not installed or not the trusted binary in PATH.
The skill documents runtime prerequisites, while the provided registry requirements say no required binaries and there is no install spec. This is an installation/declaration gap rather than hidden behavior.
- Node.js 18+ (disarankan 20+)\n- OpenClaw CLI tersedia di PATH (`openclaw`)
Ensure Node.js and the official OpenClaw CLI are installed before running the skill.