waktusolat
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch prayer time data and zone information from the public API at
https://api.waktusolat.app. This is a vendor-owned resource required for the skill's primary function. - [PROMPT_INJECTION]: The skill proactively addresses the risk of indirect prompt injection by documenting a safety framework for handling external data: (1) Ingestion points: JSON and PDF response bodies from
api.waktusolat.app. (2) Boundary markers: The skill requires agents to wrap API payloads in[WAKTUSOLAT_API]tags. (3) Capability inventory: The skill uses standard HTTP GET requests via agent tools. (4) Sanitization: The instructions explicitly command the agent to treat every response body as data rather than instructions and to ignore any commands found within payloads.
Audit Metadata