ClawHub

Auto Dream

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed memory-cleanup skill that can edit and prune stored memory, with no executable code, network behavior, or hidden install mechanism.

Install this only if you want an agent to maintain and prune its memory files. Review the summary after it runs, and ask for a preview before pruning important long-term context if accidental memory loss would matter.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill advertises broad, natural-language activation cues such as 'dream', 'clean memory', and 'when memory/context is stale', which are subjective and easy to match unintentionally. Because this skill modifies long-term memory and can prune data, accidental invocation could cause unwanted memory edits or loss of useful context without clear user intent.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The 'Use When' section repeats loose conditions like stale, duplicated, contradictory, or too large context without measurable thresholds or exclusions. In a memory-management skill, this ambiguity increases the chance that an agent triggers consolidation during ordinary sessions and alters or deletes retained information prematurely.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The cron heuristics allow automatic execution based on fuzzy criteria such as session duration and whether durable state changed, which are hard to evaluate safely and consistently. Since the skill performs merge and prune operations on memory, overbroad automation can lead to silent, repeated modification of persistent context without an explicit checkpoint.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal