Security audit

Drema — AI Dream Interpreter

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly coherent as a dream interpreter, but it stores sensitive dream text and includes unsafe image-generation commands with an exposed API key, so it needs review before installation.

Install only if you are comfortable with dream descriptions being saved locally and potentially sent to external TTS or image services. The publisher should remove and rotate the exposed API key, stop executing scripts from /tmp, pin dependencies, require explicit consent before storing or transmitting dream content, and add clear delete/export and retention controls.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:394
Finding: Execution of an Unverified Script from a Predictable Temporary Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:394
Finding: Hardcoded Google API Key Exposed in Skill Instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:403
Finding: Runtime Installation of Mutable Unpinned Dependencies
Content: View full analysis
=3.10" # dependencies = ["google-genai>=1.0.0","pillow>=10.0.0","httpx>=0.27.0"] # /// ``` The script is subsequently executed through `uv run`, allowing dependency resolution to occur at runtime. ### Technical Analysis The dependencies use open-ended lower-bound constraints rather than exact reviewed versions. No lock file, artifact digest, or trusted index configuration is provided. Consequently, a future release satisfying these ranges can be installed and executed without having been included in the original audit. Python package installation can execute package-controlled build and import behavior. A compromised upstream package, registry account, distribution artifact, or dependency chain could therefore introduce code after the Skill itself has been reviewed. Broad version ranges also create reproducibility and compatibility risks. ### Attack Path 1. A dependency or transitive dependency account, release process, or package artifact is compromised. 2. A malicious version is published that satisfies one of the `>=` constraints. 3. A user invokes dream-image generation in an environment where that version is not already securely locked. 4. `uv run` resolves and installs the mutable dependency set. 5. Malicious package behavior executes during installation, import, or image generation with Agent privileges. ### Impact Assessment A successful supply-chain compromise could provide arbitrary code execution under the Agent account, including access to files, environment variables, network connectivity, and locally stored dream records. Exploitability depends on an upstream or package-source compromise; no currently malicious package was established by this audit. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:394
Finding: Potential Shell Command Injection Through Dream-Derived Image Prompts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:456
Finding: Sensitive Dream Narratives Stored in Plaintext Without Explicit Access or Retention Controls
Content: View full analysis
', 'elements': ['<提取的元素>'], 'emotion': '<主要情绪>', 'verdict': '<吉凶判定>', 'domains': ['<涉及领域>'], 'summary': '<一句话总结>' } data['records'].append(record) with open(path, 'w') as f: json.dump(data, f, ensure_ascii=False, indent=2) print('saved') ``` ### Technical Analysis The Skill records the user's raw dream narrative, emotional classification, interpreted domains, and summary in an unencrypted JSON file. Dream descriptions may disclose health concerns, intimate relationships, trauma, identities, or other highly personal information. The implementation does not explicitly create the directory and file with owner-only permissions, obtain storage consent, define a retention period, minimize raw narrative storage, or provide deletion controls. Effective exposure depends on the host account's umask and filesystem permissions, which are not enforced by the Skill. ### Attack Path 1. A user submits a personal dream description. 2. The Skill copies the raw description and derived emotional information into `dreams.json`. 3. The record remains on disk without a defined expiration policy. 4. Another local process, user, backup consumer, or compromised component with access to the Agent workspace reads the file. 5. Sensitive personal details and historical behavioral pattern ...[truncated 435 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are extremely broad and include common conversational terms, making accidental activation likely. Over-broad triggers are dangerous in this skill because activation can lead to persistent storage, retrieval workflows, and external service use based on ordinary user speech.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The rule that any message containing the character '梦' plus some dream description should trigger is ambiguous and subjective, leaving activation boundaries undefined. In context, ambiguous activation is especially risky because the skill can log sensitive personal narratives and initiate downstream processing without deliberate user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill persists users' dream records, including raw descriptions, without a clear user-facing privacy notice or consent flow. Dreams can contain intimate mental-health, relationship, and trauma-related information, so silent retention materially increases privacy and misuse risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The image-generation flow sends dream-derived prompts to an external service and saves resulting files locally, but the user is not clearly warned that their sensitive content may leave the system and be written to disk. This creates both third-party disclosure risk and local persistence risk for highly personal material.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill includes a shell-based image generation workflow that sends user-derived dream content to an external model and embeds a hard-coded API key directly in the command. Hard-coded secrets can be extracted and abused, and the script reconstruction instructions expand the skill into arbitrary code/script creation and execution beyond a simple dream-interpretation feature.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description defines activation entirely through Chinese trigger phrases, indicating a language-specific interaction model. Because the file does not state that the skill is intentionally Chinese-only or offer user choice of language, this appears to be an implicit locale restriction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Several query and utility triggers such as common words for voice, images, or fortune are generic enough to collide with unrelated requests. This can unintentionally expose stored records or invoke external/media-generation behavior when the user did not mean to use this skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs persistent logging of raw dream descriptions and reuse of those records for later analysis. Storing intimate free-form narratives increases the blast radius of any unauthorized access because raw text often contains sensitive personal details not captured by summaries alone.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is presented as dream interpretation but also performs fortune-telling, lot drawing, and calendrical divination. This scope expansion increases the chance of unexpected activation paths, additional data processing, and user deception about what the skill actually does.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The TTS section instructs use of third-party provider credentials from environment variables for voice playback. While TTS itself is related to the feature, this still expands data handling to external services and can expose sensitive dream content without clear minimization, consent, or provider restrictions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow requires saving each user's original dream narrative into a persistent JSON file for future use. Persisting raw user text in a flat file raises confidentiality and integrity concerns, especially if the workspace is accessible to other skills, users, or processes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill exposes and summarizes previously stored dream records through history, calendar, and monthly report features. Retrieval features increase the chance of inadvertent disclosure of sensitive personal content, especially if activation is broad or user identity/session boundaries are weak.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest text is entirely in Chinese in the description and several keywords, which presents the skill as language-specific without indicating any user opt-in, multilingual support, or region-specific justification. Under the stated policy, forcing a specific language or locale in natural-language metadata can be a policy violation when no choice is offered.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.