MorningAI

• Outcome: Review
• Latest audit: May 28, 2026 · 7:57 AM UTC
• Version: 1.2.5

Overview

MorningAI is mostly a coherent AI-news reporting skill, but it automatically runs a startup shell hook that can execute code from local env files, so it should be reviewed before installing.

Install only if you are comfortable reviewing or disabling the SessionStart hook first. Avoid using this skill in untrusted project directories where .env or .claude/morning-ai.env could contain shell commands. Treat scripts/sync.sh as a broad deployment tool and review its target directories before running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill manifest exposes effective capabilities to read environment/config files, write local files, and perform network access, but it does not declare a clear permissions model. That gap weakens operator understanding and review, especially for an unattended scheduled skill that reads secrets from .env and writes outside the working directory.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The described purpose is a news tracker, but the skill also performs additional behaviors such as infographic/image generation, social-media content generation, message digests, and references to deployment/synchronization utilities. Behavior beyond the declared scope increases supply-chain and review risk because users may authorize a seemingly narrow skill that actually performs broader networked and file-writing operations.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The security section understates write behavior: onboarding writes persistent configuration under ~/.config, and later steps write social assets beyond the listed report/data/message/cache files. Inaccurate claims about storage locations and outputs can mislead users into granting trust to a skill that persists configuration and artifacts outside the advertised scope.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill registers a SessionStart hook that unconditionally launches a shell command, giving it code-execution behavior outside the narrow news-tracker function described in the metadata. Even though the current command appears to be a config check script under the plugin directory, shell execution at session start increases attack surface because it runs automatically and could be modified, replaced, or abused to execute unintended actions.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The configuration loader imports environment variables from several unrelated namespaces such as IMAGE_GEN_, MINIMAX_, SOCIAL_, and MESSAGE_, which exceed what this file actually needs to determine news-source availability. Broad secret collection increases the chance that unrelated credentials are exposed to other parts of the skill, logged, or later transmitted to external services during scheduled unattended runs.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The agent interface describes a social-media content generator for X and Xiaohongshu, which is inconsistent with the parent skill's stated purpose of scheduled AI news tracking and report generation. This kind of capability drift is security-relevant because it can cause operators to invoke or trust functionality outside the approved scope, increasing the risk of unauthorized content publication, prompt misuse, or hidden exfiltration/publishing workflows under a benign-looking news skill.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The empty matcher means the SessionStart hook is effectively unconstrained and may trigger for every session, causing the shell command to run broadly rather than only in narrowly defined circumstances. In combination with command execution, this widens exposure and makes any future change to the referenced script more dangerous because execution becomes automatic and pervasive.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sources a discovered env file with `source "$ACTIVE_ENV"`, which executes arbitrary shell code from that file, not just `KEY=value` assignments. Because this hook runs automatically on session start and searches both project-local and global paths, a malicious repository or tampered `.env` file can trigger code execution as soon as the skill initializes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The collector uses `http://export.arxiv.org/api/query`, so search terms and returned metadata are fetched over plaintext HTTP. This allows a network attacker or malicious proxy to observe queries, tamper with results, or inject malformed XML/content before parsing, which is especially relevant for an unattended scheduled collector that runs without user review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sends user-supplied prompts to an external image-generation provider via generate_batch without any explicit consent prompt, warning, or redaction step. If prompts contain proprietary report content, API keys, internal notes, or other sensitive material, this causes unintended off-box data disclosure to a third party.

Session Persistence

Medium

• Category: Rogue Agent

Content

5. **Ask about social content distribution** (optional):
   - Enable social content generation? Set `SOCIAL_ENABLED=true`
   - Which platforms? X (Twitter), Xiaohongshu (Little Red Book), or both
   - For advanced multi-account/multi-style setup, create `~/.config/morning-ai/social_channels.json` (see `skills/gen-social/SKILL.md` for schema). For quick single-channel setup, just set `SOCIAL_PLATFORM`, `SOCIAL_STYLE`, and `SOCIAL_LANG` env vars.

6. **Ask about message digest** (optional):
   - Enable concise message digest for sharing on messaging platforms (WeChat, Telegram, Slack)?

• Confidence: 83% confidence
• Finding: The skill instructs creation of persistent configuration in ~/.config/morning-ai/social_channels.json, which survives beyond the current session. Session-persistent state is security-relevant because unattended scheduled runs may continue using stored settings, potentially causing unexpected data generation or distribution behavior if the file is modified or stale.

Session Persistence

Medium

• Category: Rogue Agent

Content

if [ -f "$HOME/.config/morning-ai/.env" ] || [ -f ".claude/morning-ai.env" ] || [ -f ".env" ]; then echo "CONFIG_STATUS=READY"; else echo "CONFIG_STATUS=MISSING"; fi
   ```
   Only proceed to Step 1 if the output is `READY`.
10. If the user wants to skip API key setup and use only free sources, create a minimal config file first, then proceed to Step 1:
   ```bash
   mkdir -p ~/.config/morning-ai && echo "# morning-ai config — free sources only" > ~/.config/morning-ai/.env
   ```

• Confidence: 89% confidence
• Finding: The onboarding flow creates ~/.config/morning-ai/.env even for 'free sources only', establishing persistent state and a future trust anchor for unattended runs. Because the skill later reads configuration automatically, this persistence can affect later executions without fresh confirmation and should be treated as a security-sensitive behavior.

Static analysis

No suspicious patterns detected.