Security audit

Agent Dream

Security checks for vulnerabilities and agentic risk

Overview

The skill’s memory-consolidation purpose is clear, but its setup can automatically select and later process sensitive session transcripts from the wrong local agent without explicit approval.

Before installing, verify the generated dream-config.json points to the exact intended workspace, agentId, and sessionsPath. Do not enable scheduled runs until you are comfortable with the skill reading local session transcripts and writing consolidated memories. Prefer a pinned or otherwise trusted ClawHub CLI installation method.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/setup.js:56
Finding: Cross-Agent Session Discovery May Expose Unrelated Conversation Transcripts
Content: View full analysis
{ const sessDir = path.join(agentsDir, d, 'sessions'); return fs.existsSync(sessDir) && fs.statSync(sessDir).isDirectory(); }); if (agents.length > 0) { // Pick the agent with the most session files (likely the primary agent) let best = null; let bestCount = 0; for (const agent of agents) { const sessDir = path.join(agentsDir, agent, 'sessions'); const files = fs.readdirSync(sessDir).filter(f => f.endsWith('.jsonl')); if (files.length > bestCount) { bestCount = files.length; best = { agentId: agent, sessionsPath: sessDir }; } } if (best) return best; } } const parent = path.dirname(dir); if (parent === dir) break; // reached filesystem root dir = parent; } return null; } ``` The discovered path is subsequently used by the instructions in `SKILL.md`, lines 86-96: ```markdown ### Phase 2 — Gather Recent Signal Sources in priority order: 1. **Daily notes** (`memory/YYYY-MM-DD.md`) written since last dream 2. **Existing memories that drifted** — facts that contradict what daily notes say now 3. **Transcript search** — grep session JSONL files for narrow terms when needed: - Preferences: `prefer|don't like|偏好|喜欢|不喜欢` - Decisions: `decided|confirmed|rule|决定|确定|结论` - Lessons: `mistake|lesson|bug|fix|错了|教训|踩坑` - Emotional signal: `thanks|great ...[truncated 2947 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:16
Finding: Installation Instructions Execute an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.