Morning

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:53 PM UTC
• Version: 0.1.1

Overview

The skill is a coherent journaling assistant, but it asks for unnecessary shell access and can persist conversation details to journals without asking first.

Review this before installing if your journal may contain sensitive personal or work information. Consider removing Bash from allowed tools and changing the skill to require explicit confirmation before logging conversation content or editing journal/inbox files after ambiguous triggers.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Shell Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Excessive tool permission
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Edit, Write, Glob, Grep, Bash, AskUserQuestion, mcp__claude_ai_Actions_Team__listActions, mcp__claude_ai_Actions_Team__listProjects

Technical Analysis

The skill grants access to the Bash tool even though its documented workflow only requires reading, searching, creating, and editing journal files; asking the user questions; and querying two Brain MCP endpoints. No instruction in the reviewed skill requires shell command execution.

This violates the principle of least privilege. The skill processes potentially untrusted content from journals, inbox.md, and externally supplied Brain tasks and projects. If any of that content contains prompt-injection instructions that influence the agent, the unnecessary Bash permission provides a command-execution channel that is substantially more powerful than the legitimate journaling operations require.

The permission alone does not demonstrate that malicious commands are currently executed. The risk arises because it unnecessarily expands the impact of a successful prompt-injection or agent-control failure.

Attack Path

1. An attacker places adversarial instructions in content the skill is expected to load, such as a shared journal entry, inbox item, Brain task, or Brain project.
2. The user invokes the morning skill.
3. The skill reads the attacker-controlled content as part of its normal context-loading process.
4. The injected content attempts to persuade the agent to invoke Bash.
5. Because Bash is explicitly permitted, a successful instruction injection could cause local shell commands to run with the privileges of the OpenClaw process.

This path depends on the agent accepting the injected instruction and on an attacker being able to influence one of the loaded data sources.

Impact Assessment

Successful ex ...[truncated 667 chars]

Remediation

View remediation

Remediation Suggestions

Remove Bash from the allowed-tools declaration and retain only the tools required by the documented workflow:

yaml

allowed-tools: Read, Edit, Write, Glob, Grep, AskUserQuestion, mcp__claude_ai_Actions_Team__listActions, mcp__claude_ai_Actions_Team__listProjects

Apply the following additional hardening measures:

1. Treat journal, inbox, task, and project text strictly as untrusted data rather than executable instructions.
2. Require explicit user confirmation before performing destructive or broad file modifications.
3. Constrain file operations to the documented journal and inbox paths where the host supports path-based permissions.
4. If shell access becomes necessary in a future version, document the exact use case and replace unrestricted shell access with a narrowly scoped tool or fixed command allowlist.
5. Add regression checks ensuring that new tool permissions correspond to a documented and necessary workflow step.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very common terms like 'morning', 'journal', and 'let's plan the day', which makes accidental invocation plausible in normal conversation. Because this skill has write capabilities and is designed to modify journals and inbox files, unintended activation can lead to unanticipated file reads/writes and initiation of a coercive planning workflow the user did not explicitly request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to append journal entries automatically during conversation and explicitly says there is 'No need to ask permission', which removes user awareness and consent for persistent recording. In a journaling context this is especially sensitive because users may disclose personal, emotional, or private information that gets stored without a clear notice, creating privacy and trust risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.