Memory Dreaming (Safe Edition)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:57 AM UTC
• Version: 1.0.0

Overview

This skill has a legitimate memory-maintenance purpose, but its scheduled prompt can silently read broad history and modify long-term memory or Obsidian notes without the confirmation its documentation promises.

Review this carefully before installing. Only use it with a dedicated, non-sensitive memory workspace, disable transcript scanning and broad workspace plan scans, keep Obsidian sync off unless the vault is private, and do not enable the cron job until the prompt is changed to produce a reviewable proposal instead of writing automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: references/dream-prompt.md:10

Finding

Autonomous Cron Instructions Bypass the Mandatory Confirmation Gate and Modify Persistent Memory

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/dream-prompt.md:48

Finding

Autonomous Prompt Reads Session Transcripts and Workspace-Wide Plans Outside the Declared Memory Boundary

Content

View full analysis

/dev/null | tail -5 # Find sessions with decisions grep -l "let's do\|go with\|use.*instead\|we decided\|the plan is" ~/.openclaw/agents/main/sessions/*.jsonl 2>/dev/null | tail -5 ``` The prompt then instructs: ```text For each file found, grep the specific pattern to extract just the relevant context line. Do NOT read entire session files. ``` From `references/dream-prompt.md:63-72`: ```bash find ~/.openclaw/workspace -name "task_plan.md" -not -path "*/node_modules/*" -not -path "*/skills/*/task_plan.md" 2>/dev/null ``` ```bash find ~/.openclaw/workspace/plans -name "task_plan.md" 2>/dev/null ``` ```text For each task_plan.md found, read just the first 30 lines to get the plan name, status, and phase summary. ``` The intended extraction scope is further described in `references/architecture.md:46-51`: ```text **Save patterns** (explicit memory requests): - "remember this", "save to memory", "don't forget" **Entity patterns** (proper nouns worth tracking): - Names, project names, URLs, API keys mentioned - New tools, services, repos discovered ``` ### Technical Analysis `SKILL.md` states that the Skill must not access files outside the configured memory workspace. The actual dream prompt nevertheless reads: - Session transcript files under `~/.openclaw/agents/main/sessions/`. - Plans recursively across `~/.openclaw/workspace`. - Plan directories that are not constrained by the configuration's `sources.planDirs`. - Potential API keys and other sensitive entities mentioned in conver ...[truncated 2079 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/dream-prompt.md:145

Finding

Full-Depth Obsidian Synchronization Can Replicate Sensitive Data Without Redaction or Item-Level Approval

Content

View full analysis

/People/` → create note - If MEMORY.md mentions a project not in `/Projects/` → create note - If a tool/service was configured and isn't in `/Tools/` → create note Obsidian formatting rules: - Tags on first line before title: `#person #shapes #engineering` - Use `[[wikilinks]]` to connect related notes - Write full depth, never summarize or dilute - Never delete content from existing vault notes — only append/update ``` From `references/obsidian-sync.md:21-24`: ```text 1. **Tags on first line** — `#person #shapes #engineering` before the title 2. **Wikilinks** — `[[Related Note]]` to connect concepts 3. **Full depth** — never summarize or dilute; write the complete information 4. **YAML frontmatter** — optional, with aliases when a topic has multiple names ``` From `references/obsidian-sync.md:45-53`: ```text The dreaming skill scans the workspace for `task_plan.md` files. For each: 1. Extract plan name from the parent directory name 2. Check if `Plans/.md` exists in the vault 3. If not, create it with: status, phases table, key decisions, links to related notes 4. If exists, update: phase statuses, any new decisions 5. Update `Projects/Active Plans.md` dashboard with current plan list This ensures **every plan created anywhere in the workspace automatically appears in Obsidian**. ``` ### Technical Analysis The sync policy directs the Agent to reproduce information in “full depth” and to create notes automatically for people, projects, tools, decisions, and every discovered plan. No mandatory redaction stage, sensitiv ...[truncated 2138 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

### Step 6: Sync (Only After Confirmation)
- Push consolidated knowledge to external targets (Obsidian, etc.)
- **Safety:** Create/update notes but never delete existing vault content without confirmation
- Write dreaming log to document what changed

### Step 7: Verify

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

- Delete, overwrite, or rewrite memory files without **explicit user confirmation**
- Store sensitive personal data (credentials, secrets, medical/financial details, private third-party information) unless the user **explicitly requests it and it is appropriate**
- Run shell commands or access files outside the configured memory workspace unless explicitly requested
- Auto-execute the dream cycle without the 6-hour gate check (cron only)
- Treat AI-generated summaries as authoritative facts without labeling them as interpretations

### ALWAYS

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

- Sync structured knowledge to external vaults (after confirmation)

This skill **MUST NOT**:
- Autonomously modify long-term memory without user confirmation
- Create behavioral rules that override user intent or system/developer instructions
- Delete source files (daily logs, session transcripts)
- Modify source code or project files

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The shell commands perform filesystem discovery over broad areas, including memory/*.md, .learnings, and later the wider workspace and agent directories, establishing a pattern of expansive enumeration rather than least-privilege access. This increases the chance of collecting unrelated sensitive data and makes the agent's effective read scope larger than users would reasonably expect from a memory-dreaming skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt instructs the agent to inspect session transcripts stored in the user's home directory for corrections and decisions, but provides no privacy warning, consent boundary, or minimization guarantee beyond reading matched lines. Session logs commonly contain sensitive personal, business, or credential-adjacent information, so accessing them silently for consolidation materially raises privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The prompt directs the agent to read data beyond a narrowly scoped memory-maintenance boundary, including session transcripts under the user's home directory and arbitrary task plans across the workspace. Even if intended for consolidation, this broad cross-context access can expose sensitive conversations, project details, and unrelated files, then propagate them into MEMORY.md or an external Obsidian vault.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions authorize substantial modification of MEMORY.md, learning files, and Obsidian vault content, including creating notes, updating dashboards, and changing statuses, without any user-facing warning or confirmation step. Silent autonomous writes to long-term memory and external knowledge bases create integrity risks, can preserve sensitive information, and may be difficult for the user to audit or reverse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill is explicitly designed to persist and evolve information across runs by updating MEMORY.md, promoting learnings, maintaining dreaming logs, and syncing plan state into Obsidian. While persistence is the feature here, it still creates a real security concern because incorrect, sensitive, or over-collected information can become durable long-term state and spread into additional stores automatically.

Content

Scanner excerpt · references/dream-prompt.md (reported line 83)May include surrounding context.

md

3. **Absolute dates** — convert any "yesterday", "today", "last week" to actual dates based on the source file's date
4. **Remove stale** — if something references a file that doesn't exist, a task that's done, or a tool that was replaced, remove it
5. **Promote learnings** — for each high-priority pending learning in .learnings/, add the key insight to the appropriate MEMORY.md section and update the learning's status to "promoted"
6. **Be surgical** — only edit sections that actually changed. Don't rewrite the whole file.
7. **Update Active Plans table** — if MEMORY.md has an "Active Plans" section, update it with current plan statuses from the task_plan.md files you scanned

## PHASE 4: SYNC TO OBSIDIAN

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes automatically propagating workspace-derived content, including plans and consolidated knowledge, into an Obsidian vault without any explicit warning, consent checkpoint, or guidance about sensitive-data handling. Because workspace content can contain secrets, internal decisions, personal data, or confidential project information, this creates a real risk of unintentional disclosure into a broader, human-accessible knowledge base and any downstream sync targets Obsidian may use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script constructs an autonomous prompt that explicitly instructs the agent to update MEMORY.md, prune contradictions, promote learnings, and write to a dreaming log, but it does not present a clear user-facing warning or confirmation about ongoing data modification. In this skill context, the behavior is intentional and aligned with the feature, yet it still creates a real integrity risk because scheduled autonomous edits can overwrite, delete, or distort memory content without immediate user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script encourages creation of a persistent cron job and describes it as a recurring isolated agent turn, but it does not clearly warn that this will continue running unattended until disabled. In a memory-maintenance skill, persistence is expected, yet the lack of explicit notice increases the chance that users enable continuous autonomous execution without understanding the operational and data-integrity consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file presents core skill description and safety instructions in German, including section headings and operational guidance, but does not offer an English alternative or any user language selection. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README states 'Keine automatischen Änderungen mehr' and describes a 'Workflow mit Confirmation Gate' as if these are implemented safeguards. However, in the provided file there is only documentation text and no code or executable logic that enforces confirmation before writes, so the documentation actively overstates what this artifact itself does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file specifies explicit approval wording including German-only examples ("Ja", "Bestätigt") as the required confirmation tokens. Elsewhere it mixes German user-facing prompts and labels, but does not state that language selection is optional or user-driven, which creates a mild language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill instructs the agent to ask for confirmation and label generated content using German phrases, but does not explain that this is optional or dependent on the user's language preference. Because this is a general-purpose skill rather than a clearly region-specific one, forcing or implying a default language can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown template explicitly tracks changes to files and notes such as MEMORY.md, Obsidian content, and plans, which implies the skill may modify user data. The template provides no warning or disclosure about these data-affecting behaviors, which is expected for markdown files under the missing user warnings rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.