OpenDream

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.1

Overview

OpenDream is a coherent local dream/heartbeat skill, but installation gives it durable control over agent behavior and scheduled local memory processing with limited user confirmation.

Install only if you want this skill to modify persistent OpenClaw behavior, run a recurring nighttime heartbeat, read daily memory notes, and store derived dream history. Review the setup diff first, back up HEARTBEAT.md, SOUL.md, and openclaw.json, check any existing heartbeat configuration before running setup, and delete dreams/ if you do not want retained dream records.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/setup.py:108

Finding

Persistent Modification of Global Agent Instructions

Content

View full analysis

bool: """Merge the dream section into HEARTBEAT.md. Returns True if modified.""" target = workspace / "HEARTBEAT.md" section = HEARTBEAT_SECTION.read_text() if target.exists(): existing = target.read_text() if DREAM_MARKER in existing: info("HEARTBEAT.md already contains dream section — skipping") return True backup(target) merged = existing.rstrip() + "\n\n" + section.strip() + "\n" target.write_text(merged) info("Merged dream section into existing HEARTBEAT.md") else: header = "# Heartbeat checklist\n\n" daytime = ( "## Daytime (06:00-23:00)\n" "- Quick scan: anything urgent in reminders, calendar, or inboxes?\n" "- If nothing urgent, reply HEARTBEAT_OK.\n\n" ) target.write_text(header + daytime + section.strip() + "\n") info("Created HEARTBEAT.md with dream section") return True def merge_soul(workspace: Path) -> bool: """Merge the dream persona fragment into SOUL.md. Returns True if modified.""" target = workspace / "SOUL.md" fragment = SOUL_FRAGMENT.read_text() if target.exists(): existing = target.read_text() if DREAM_MARKER in existing: info("SOUL.md already contains dream persona — skipping") return True backup(target) merged = existing.rstrip() + "\n\n" + fragment.strip() + "\n" target.write_text(merged) info("Merged dream persona fragment into existing SOUL.md") else: target.write_text(fragment.strip() + "\n") info("Created SO ...[truncated 2447 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.py:196

Finding

Existing Heartbeat Configuration Is Replaced Wholesale

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: assets/HEARTBEAT-dream-section.md:33

Finding

Recurring Broad Read and Derivative Storage of Daily Memory

Content

View full analysis

` (with the current time) to `dreams/YYYY-MM-DD/cycle-{N}-{name}.md` 7. Reply HEARTBEAT_OK ### REM tick (active phase — all subsequent ticks in a cycle): 1. Read `skills/opendream/assets/prompts.yaml` — follow `system_base` rules and your current cycle's `instruction`, `style`, and `depth` 2. Use file tools to read `memory/YYYY-MM-DD.md` for today's context (skip if missing or empty). Extract people, friction, tasks, and observations — follow the `memory_context` guidance in prompts.yaml. Do not read `MEMORY.md`. 3. Read the current cycle file in `dreams/YYYY-MM-DD/` to avoid repeating thoughts 4. Generate ONE dream thought shaped by this cycle's purpose, examples, and depth. Respect the word range for this cycle's depth level. 5. Append it to `dreams/YYYY-MM-DD/cycle-{N}-{name}.md` 6. Reply HEARTBEAT_OK — do not send the thought externally ``` The extraction guidance expands the requested data scope: ```yaml memory_context: instruction: | You have read today's daily notes from memor ...[truncated 3370 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to handle the agent's dream-state interactions, but it also behaves like a CLI validator/setup tool that inspects files, parses configuration, and exits with status semantics. Hidden operational behavior increases risk because a runtime skill can become an unexpected administrative tool with broader local access than users anticipated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims to handle the agent's dream-state interactions, but it also behaves like a CLI validator/setup tool that inspects files, parses configuration, and exits with status semantics. Hidden operational behavior increases risk because a runtime skill can become an unexpected administrative tool with broader local access than users anticipated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is supposed to handle the agent's internal dream-state process, but the daytime branch instructs access to reminders, calendar, and inboxes, expanding its scope into unrelated personal data sources. This creates unnecessary authority and privacy exposure because merely invoking or scheduling the skill could cause inspection of sensitive data without a clear user-facing need tied to the skill's purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Inspecting reminders, calendar, and inboxes is unjustified for a dream-process skill and violates least-privilege design. Even if no exfiltration is explicitly described, unauthorized reading of these sources can reveal sensitive schedules, tasks, communications, and relationships, making the skill dangerous in context.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/HEARTBEAT-dream-section.md (reported line 41)May include surrounding context.

md

3. Read the current cycle file in `dreams/YYYY-MM-DD/` if it exists
4. Read this cycle's `nrem_guidance` from prompts.yaml and follow it during context gathering
5. Do NOT generate a dream thought. This is the quiet phase — absorb, do not speak.
6. Append `<!-- NREM HH:MM -->` (with the current time) to `dreams/YYYY-MM-DD/cycle-{N}-{name}.md`
7. Reply HEARTBEAT_OK

### REM tick (active phase — all subsequent ticks in a cycle):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly instructs reading and writing workspace files, but it does not declare a corresponding tool scope or permission boundary. That creates a capability mismatch where a reviewer or host may assume this is a harmless conversational skill, while it actually performs persistent filesystem actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document states 'This is not a script that runs' and later claims 'No scripts,' yet it instructs execution of setup, validation, and viewer scripts. Contradictory guidance is risky because it obscures the true attack surface and can socially engineer operators into running local code they were led to believe did not exist.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill persistently appends generated thoughts and writes a morning recall to disk, creating session persistence of internal reasoning-like content. Persistent storage can become sensitive if it captures contextual information from daily notes or user-adjacent workspace data, and the skill does not define retention, access controls, or sanitization.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

During each heartbeat tick in a cycle, generate one dream thought and append it
to the current cycle's dream file in `dreams/YYYY-MM-DD/`.

At 06:00, write a morning recall summarising the night.

---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Saying 'No scripts' in the setup section is materially misleading when the skill repeatedly recommends running Python utilities. Misrepresentation of execution requirements reduces informed consent and increases the chance that administrative actions will be taken without appropriate review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The optional live viewer adds a local web server and WebSocket event streaming capability that goes beyond the core stated purpose of internal dream processing. Even if bound locally, exposing generated content over HTTP/WebSocket increases attack surface and can leak sensitive internal state or persisted notes to other local users/processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to append to and create files under dreams/YYYY-MM-DD/ and morning-recall.md as part of normal execution, but provides no user warning, consent flow, or data-retention controls. Silent local writes are risky because they persist internal content, may accumulate sensitive inferred information from memory files, and can surprise users who did not intend the skill to modify storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setting hard-codes "Europe/London", which is a locale-specific constraint. Under the policy, locale restrictions should either be user-selectable or clearly documented as justified for a region-specific use case; neither is evident in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The installation steps instruct the user to append content into persistent configuration files (HEARTBEAT.md) without an explicit warning that this permanently modifies agent behavior and may duplicate sections if rerun. In a security-sensitive agent environment, silent config mutation can lead to unintended behavior changes, difficult rollback, and accidental corruption of local policy files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These instructions append a persona fragment into SOUL.md, a persistent file that likely affects long-term agent identity or behavior, without prominently warning about the durable modification. Because persona files are high-impact control surfaces, silent appends can alter agent responses beyond the user's expectations and can be hard to audit if repeated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Creating a persistent dreams/ directory, together with the documented use of memory/YYYY-MM-DD.md and overnight heartbeat scheduling, establishes ongoing session/state persistence. In the context of an agent skill, this increases the data retention surface and may preserve sensitive internal state or behavioral artifacts without a prominent retention notice or lifecycle controls.

Content

Scanner excerpt · references/INSTALL.md (reported line 44)May include surrounding context.

Check: Your SOUL.md should now end with a ## Dream mode (23:00–06:00) section mentioning "ElectricSheep mode".

Step 4: Create dreams directory

bash

mkdir -p ~/.openclaw/workspace/dreams

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document first states that the dream persona and cycle instructions live in prompts.yaml, and later points to assets/prompts.yaml as the single source of truth read each tick. However, lines 138-139 say the effective prompts live in HEARTBEAT.md and SKILL.md, not in a separate YAML file. These statements actively contradict each other about where the runtime instructions actually reside.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code writes or modifies HEARTBEAT.md, SOUL.md, dreams/, and openclaw.json immediately once the script is run, and there is no interactive confirmation step before those changes occur. Although the module docstring explains what the script does, the lack of a last-step user confirmation is notable because it overwrites live workspace configuration, including heartbeat settings.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The heartbeat prompt instructs the agent to read and strictly follow external files, but it does not constrain what 'needs attention' means or limit the actions the heartbeat may take. In a recurring unattended context, this creates a prompt-injection and scope-expansion risk because any risky or adversarial content in the referenced files could be executed or acted on automatically during the scheduled window.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The configuration example hard-codes Europe/London as the active timezone, which imposes a locale-specific default in the installation instructions. Although a later section explains how to change it, the initial setup still directs users toward a specific locale without first asking for their preference.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The reference describes status checking via a .dream_active marker file, but the earlier architecture and generated runtime files only describe cycle files and morning-recall.md, with no marker-file creation step. This is an intent/documentation divergence because the operational check references an artifact not described anywhere in the documented behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.