Security audit
Security checks for vulnerabilities and agentic risk
This skill is not malicious, but it can automatically rewrite and prune persistent agent memory without a clear confirmation or rollback step.
Install only if you are comfortable with a skill that may modify or delete agent memory entries. Prefer using it manually, review proposed memory changes before applying them, and avoid enabling automatic runs unless your environment provides approval, logs, and a way to restore prior memory.
The skill metadata includes broad natural-language triggers such as 'dream', 'consolidate memory', 'clean memory', and 'prune context', which could cause activation during ordinary conversation rather than a clearly intentional maintenance request. Because this skill edits and prunes memory, accidental invocation can lead to unintended modification or deletion of persisted context.
The 'Use When' section repeats ambiguous triggers without defining strict invocation conditions, increasing the chance that the skill is used based on casual phrasing or weak heuristics. In the context of a memory-editing skill, over-broad activation is risky because it can silently rewrite, merge, or prune important agent memory.
The cron trigger heuristics authorize automatic execution based on session characteristics and memory size, but the skill does not require an explicit warning or confirmation that memory files will be modified. Automatic pruning and merging of persistent memory can cause silent data loss, unwanted retention changes, or corruption of user-important context if the heuristics fire incorrectly.
The specified output begins with the fixed phrase '🌙 Dream abgeschlossen', which requires German output regardless of the user's language preference. There is no indication that the user can choose the language or that this locale constraint is justified.
No suspicious patterns detected.
