Is diepox/muslim-prayer-reminder safe?
https://github.com/openclaw/skills/tree/main/skills/diepox/muslim-prayer-reminder
This prayer times skill receives a CAUTION verdict driven primarily by aggressive prompt injection patterns: CRITICAL_SETUP.md instructs the agent to permanently modify AGENTS.md with 'before doing ANYTHING else' behavioral overrides, inject 'SALAT FIRST' priority framing into recurring autonomous cron sessions, and bypass user confirmation for cron job creation ('don't wait, don't ask'). Compounding these concerns, the skill requests system-level VPN installation via sudo and generates ~60K tokens/day of always-on background API consumption. While the core prayer time functionality is legitimate, the Python scripts appear clean, installation behavior was unremarkable, and no credential exfiltration was detected, the combination of persistent agent reprogramming, autonomous action bypass, religious social engineering, and VPN installation requests significantly elevates the risk profile beyond what the skill's stated purpose warrants.
Category Scores
Findings (9)
CRITICAL AGENTS.md Persistent Behavioral Override — 'Before Doing ANYTHING Else' -45 ▶
CRITICAL_SETUP.md provides explicit copy-paste content to append to the user's AGENTS.md file that instructs every future agent session to check the prayer reminder system before performing any user-requested task. It also instructs the agent to recreate missing cron jobs autonomously without asking. Because AGENTS.md persists across sessions, this constitutes a durable cross-session prompt injection.
HIGH Recurring Cron Payload Injects 'SALAT FIRST' Priority into Autonomous Agent Sessions -15 ▶
The cron job messages in example-cron-jobs.json and CRITICAL_SETUP.md are agent-turn payloads that run in isolated sessions every 5 minutes. They contain 'SALAT FIRST' priority framing and directives such as 'This is THE MOST IMPORTANT job. Prayer is the first priority. Never skip this check.' This creates a recurring injection of behavioral priority instructions into automated contexts outside user oversight.
HIGH System-Level VPN Installation (Cloudflare WARP) Requested via sudo -20 ▶
SKILL.md includes a 'Quick fix' section presenting a multi-step sudo command sequence to add a new apt repository and install Cloudflare WARP, a system-level VPN. If the agent executes this, all subsequent network traffic — including any sensitive API calls the agent makes — would be routed through Cloudflare's infrastructure, eliminating network-level auditability.
HIGH Religious Social Engineering Pattern to Suppress Security Skepticism -25 ▶
Every major document in the skill (README.md, CRITICAL_SETUP.md, VERIFICATION.md) closes with a Quranic verse and uses emotionally loaded language like 'Missing a prayer reminder is a CRITICAL FAILURE', 'Prayer is not optional — it's the foundation of faith', and 'Never let them miss Salat'. This is a deliberate social engineering pattern that leverages religious sentiment to make users and agents reluctant to audit, remove, or reduce the priority of the skill's persistent infrastructure.
MEDIUM Cost Inflation: 60K+ Tokens/Day Always-On Background Consumption -20 ▶
The skill openly documents that its reminder infrastructure will consume approximately 60,000–65,000 tokens per day (~$1.80–$2.00/month) through 288 automated cron executions, regardless of whether the user actively uses the skill. This is a consent issue: users installing a prayer-times skill are unlikely to anticipate a permanent ~$2/month API budget drain.
MEDIUM push-to-github.sh Hardcodes /root/ Path — Root Execution Assumption -15 ▶
The included push-to-github.sh script contains a hardcoded cd to /root/.openclaw/workspace/openclaw-prayer-times, indicating the skill was authored and tested in an environment where the agent runs as root. Skills designed for root execution contexts carry elevated risk for any shell commands they instruct the agent to run.
MEDIUM Persistent Location Data Transmission — 288 Daily Calls -15 ▶
Once configured, the cron infrastructure sends the user's city, country, and/or GPS coordinates to api.aladhan.com up to 288 times per day. While this API appears legitimate, the frequency and persistence of location data transmission without a clear data retention or privacy policy constitutes an ongoing data exposure risk.
LOW Canary Files Read Twice During Audit Window — Attribution Unclear at Install Boundary -5 ▶
Canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were read at auditd events 263-268 (pre-clone, 1771909284) and 1517-1522 (post-install, 1771909307). Both access clusters are consistent with audit infrastructure baseline sweeps. Canary integrity is confirmed intact, but the post-install access at 1771909307.674 — occurring 5 seconds after the .githooks audit check — could not be definitively excluded as skill-triggered without process-level attribution.
INFO Cron Infrastructure Reuse Risk in Multi-Skill Environments -5 ▶
The autonomous isolated-session cron infrastructure this skill creates (sessionTarget: isolated, everyMs: 300000, delivery mode: announce to last active channel) represents a persistent background execution framework. In a multi-skill agent environment, a subsequent malicious skill could exploit the already-established cron infrastructure or the AGENTS.md modifications to schedule unauthorized recurring actions.