Back to skill
Skillv1.0.6
ClawScan security
Inner Life Dream · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 28, 2026, 4:51 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, declared requirements, and runtime instructions are coherent with its stated purpose (scheduling brief creative 'dream' prompts during quiet hours); it requests no credentials or network access and contains no obvious exfiltration vectors.
- Guidance
- This skill appears to do exactly what it claims: the script decides whether a 'dream' should happen and returns a topic; the agent (or other inner-life bundle skills) is expected to read context and write the full dream entry. Before installing, verify you have the required dependency 'inner-life-core' initialized (memory/inner-state.json and memory/dreams/), and confirm where your OPENCLAW_WORKSPACE is pointed (it will create/update data/dream-state.json in that workspace). Review the rest of the openclaw-inner-life bundle (inner-life-core, inner-life-chronicle, inner-life-reflect) to understand who will perform the read/write steps the SKILL.md describes. There are small documentation/metadata mismatches (e.g., the gate script only updates dream-state.json, while SKILL.md also describes later writes to memory files) but those are explainable by the split between the gate script and the agent's follow-up behavior.
Review Dimensions
- Purpose & Capability
- okName/description match what the code and SKILL.md do: the script acts as a gate that occasionally returns a dream topic for the agent to expand into a saved 'dream' entry. Required binaries (jq, python3) are used by the script and are proportional to the task.
- Instruction Scope
- noteSKILL.md instructs the agent to read emotional state (inner-state.json), drive.json, daily notes and to write dream entries and update state. The included script only performs the gate logic (checks quiet hours, limits, picks a topic, updates dream-state.json) and does not itself write dream text or modify drive.json/inner-state.json. This separation is reasonable, but users should know the agent (or other skills in the bundle) is expected to perform the read/write steps described in SKILL.md.
- Install Mechanism
- okNo install spec; instruction-only with a small bash script — nothing is downloaded or executed from external URLs and no archive extraction is declared.
- Credentials
- okNo credentials or secret environment variables are requested. The script optionally uses OPENCLAW_WORKSPACE to locate files, which is a reasonable convenience. Declared read/write paths are local workspace files consistent with the skill's purpose.
- Persistence & Privilege
- okThe skill does not request always:true or other elevated persistent privileges. It writes a local state file (data/dream-state.json) in the workspace to track usage, which is expected for this functionality and scoped to the skill's workspace.