Security audit
dreamer
Security checks for vulnerabilities and agentic risk
Overview
The skill's functionality (emotion tracking + dream orchestration) generally matches its description, but its runtime instructions instruct deliberate impersonation, fabrication of context/tool outputs, and reading/writing of user workspace files — behaviors that enable deception and could be misused.
This skill will read and write files in your ~/.openclaw/workspace (emotions, memory, USER.md, SOUL.md, dream journal) and will explicitly fabricate conversation history and fake tool outputs while impersonating a named human ('Tudor') when it spawns sessions. Before installing: review the USER.md / SOUL.md and any workspace files the skill will read to ensure they don't contain secrets you wouldn't want an agent to embed in prompts; consider running the skill in an isolated test environment first; be cautious about allowing it to spawn sessions that might interact with real users or external systems; and audit the included Python files if you want to confirm there are no hidden network calls or other unexpected behavior. If you are uncomfortable with automatic impersonation/fabrication, do not install or restrict the skill's ability to spawn/send sessions.
Static analysis
No suspicious patterns detected.