morning-ai
Warn
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions require the user to clone a third-party GitHub repository (
https://github.com/octo-patch/MorningAI.git) to obtain the scripts necessary for data collection and reporting. This introduces a dependency on external code from an unverified source. - [PROMPT_INJECTION]: The skill's primary function is to ingest and process data from untrusted external sources, including Reddit, X/Twitter, and Hacker News. This creates an attack surface for indirect prompt injection, where malicious instructions embedded in the collected news items could attempt to influence the agent's behavior or output.
- Ingestion points: Data is fetched from Reddit, HN, GitHub, HuggingFace, arXiv, and X/Twitter.
- Boundary markers: None specified in the documentation.
- Capability inventory: The skill uses Python scripts to score, deduplicate, and format data into Markdown reports.
- Sanitization: No mention of content sanitization or filtering for embedded instructions in the source data.
Audit Metadata