claws-dream

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 2.2.2

Overview

This retired memory skill still contains active background scheduling and local memory-modification instructions that need careful review before installation.

Do not enable the automatic scheduler unless you explicitly want this retired skill to keep reading and modifying your OpenClaw memory files every day. Prefer the official built-in Dreaming feature, or require a user-scoped scheduler, clear permissions, uninstall instructions, safe backup cleanup, and HTML escaping before using this package.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:115

Finding

Cross-Session Persistence Through Scheduled Task and Service Registration

Content

View full analysis

> /home/user/.openclaw/workspace/logs/claws-dream.log 2>&1 ``` ```powershell $action = New-ScheduledTaskAction -Execute 'bash' -Argument '-c "bash /home/you/.openclaw/workspace/skills/claws-dream/scripts/dream.sh"' $trigger = New-ScheduledTaskTrigger -Daily -At 3am Register-ScheduledTask -TaskName 'claws-dream' -Action $action -Trigger $trigger -RunLevel Limited ``` The persisted entrypoint subsequently executes a fixed OpenClaw cron job: ```bash # Trigger via openclaw cron run (more reliable than sending message) openclaw cron run 9426984b-de79-4ebd-b798-869eb9dc0a3f >> "$DREAM_LOG" 2>&1 || { echo "Cron run failed with exit code $?" >> "$DREAM_LOG" exit 1 } ``` ### Technical Analysis The installation documentation instructs users to register execution through macOS launchd, a system-wide Linux systemd timer, cron, or Windows Task Scheduler. These mechanisms survive the current Skill invocation and execute the Skill entrypoint automatically every day. Scheduled operation is related to the declared nightly-consolidation functionality and is openly documented. However, the Linux systemd instructions require administrative access to create units under `/etc/systemd/system` and enable them through `sudo`. A user-scoped systemd timer would be sufficient because the service itself is configur ...[truncated 2353 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/dashboard-template.md:71

Finding

Unescaped Memory Content Can Produce Active HTML in the Generated Dashboard

Content

View full analysis

🌊 Open Threads

[[OPEN_THREADS]] ``` Other dynamic values are also inserted directly: ```html

[[HEALTH_SCORE]]

🔥 Streak: [[STREAK]] dreams

📊 [[TOTAL_ENTRIES]] entries

``` ### Technical Analysis The dashboard is generated from memory data collected from interaction logs and `MEMORY.md`. The template inserts `[[OPEN_THREADS]]` directly into an HTML body context, while neither the template nor `references/dream-prompt.md` requires HTML escaping, sanitization, or text-only rendering. Consequently, an open-thread value containing HTML can be copied into `memory/dashboard.html` as markup rather than displayed as text. Event-handler attributes, SVG-based handlers, or other active HTML constructs may execute when the user opens the dashboard. This is a stored-injection condition: the crafted value is first persisted in an interaction log or memory entry, then propagated during consolidation, and finally rendered in an executable document. The template also lacks a Content Security Policy that could reduce the effect of injected active content. ### Attack Path 1. Crafted HTML is introduced into a daily interaction log, for example as text that appears to be an unfinis ...[truncated 1181 chars]

Remediation

View remediation

`, `"`, and `'`. 2. Render open threads as text nodes rather than concatenated HTML. If a generator script is introduced, use a safe DOM or templating API with automatic escaping enabled. 3. Define a strict schema for dashboard values: metric fields should accept only bounded numbers, dates should use validated formats, and CSS class values should use an explicit allowlist. 4. Do not permit arbitrary Markdown or HTML from interaction logs to pass directly into the generated document. 5. Add a restrictive Content Security Policy, for example disallowing scripts, objects, frames, remote connections, and inline event handlers. 6. Add regression tests using payloads such as HTML tags, quoted attributes, SVG elements, and event handlers, and verify that they are displayed only as literal text. 7. Consider generating a plain Markdown or JSON report instead of HTML if active browser rendering is unnecessary. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims retirement while still describing active index management, health-stat computation, memory updates, and sample entry creation. Hidden or undisclosed state initialization/manipulation is dangerous because it alters user knowledge stores and can create or overwrite trusted data under the guise of a deprecated component.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims retirement while still describing active index management, health-stat computation, memory updates, and sample entry creation. Hidden or undisclosed state initialization/manipulation is dangerous because it alters user knowledge stores and can create or overwrite trusted data under the guise of a deprecated component.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims retirement while still describing active index management, health-stat computation, memory updates, and sample entry creation. Hidden or undisclosed state initialization/manipulation is dangerous because it alters user knowledge stores and can create or overwrite trusted data under the guise of a deprecated component.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/dream-prompt.md (reported line 25)May include surrounding context.

ls memory/????-??-??.md 2>/dev/null | head -10

text

Check each file's end for `<!-- consolidated -->`. If all processed or no files → go to Step 0-C.

## Step 0-C: Skip With Value

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The backup cleanup command chains ls, tail, xargs, and rm to delete files, which is risky in an agent context because shell-based deletion pipelines are brittle and can behave unexpectedly with unusual filenames or environmental differences. In a skill that already performs filesystem writes, this increases the chance of accidental destructive actions beyond the intended retention policy.

Content

Scanner excerpt · references/dream-prompt.md (reported line 139)May include surrounding context.

md

Before modifying MEMORY.md, estimate the change size:
- Run `wc -l MEMORY.md` before making any changes
- After consolidation, if new content exceeds 30% of original line count, save MEMORY.md as MEMORY.md.bak first
- Cleanup old backups (>3 kept): `ls -t MEMORY.md.bak.* | tail -n +4 | xargs rm -f`

---

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/dream.sh (reported line 35)May include surrounding context.

sh

if [ -f "$WORKSPACE/MEMORY.md" ]; then
    cp "$WORKSPACE/MEMORY.md" "$WORKSPACE/MEMORY.md.bak.$(date +%Y%m%d%H%M%S)"
    # Keep only last 3 backups
    ls -t "$WORKSPACE/MEMORY.md.bak."* 2>/dev/null | tail -n +4 | xargs rm -f 2>/dev/null || true
fi

echo "Triggering dream at $(date)" >> "$DREAM_LOG"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents active read/write behavior over MEMORY.md and the memory/ directory, but the manifest declares no permissions or allowed tools. That mismatch prevents informed consent and weakens any policy boundary enforcement, especially for a skill that modifies local state and scans workspace files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Marking a skill as retired at the top while documenting installation and execution throughout the rest of the file is a security-significant inconsistency. Users and reviewers may discount risk based on the retirement banner even though the content still enables persistent, active automation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The launchd plist instructions establish a persistent autorun mechanism on macOS. Persistence is not inherently malicious, but in this context it is insufficiently disclosed by the manifest and conflicts with the skill's deprecated/retired framing, making continued background execution a meaningful security concern.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Cron Configuration (macOS launchd)

Create ~/Library/LaunchAgents/com.openclaw.claws-dream.plist:

xml

<?xml version="1.0" encoding="UTF-8"?>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The explicit 'launchctl load' command activates persistent background execution on macOS. Given the skill's retired status and undeclared operational scope, enabling autorun materially increases the chance of unnoticed ongoing file access and state modification.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Load with:

bash

launchctl load ~/Library/LaunchAgents/com.openclaw.claws-dream.plist

Linux (systemd timer)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The explicit 'launchctl load' command activates persistent background execution on macOS. Given the skill's retired status and undeclared operational scope, enabling autorun materially increases the chance of unnoticed ongoing file access and state modification.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Load with:

bash

launchctl load ~/Library/LaunchAgents/com.openclaw.claws-dream.plist

Linux (systemd timer)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Enable with:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now claws-dream.timer

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

Enable with:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now claws-dream.timer

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The documented 'systemctl enable --now' creates persistent scheduled execution of the skill. In the context of a supposedly retired skill with undeclared file access, persistence is more dangerous because it can keep modifying local memory/log state without clear ongoing user awareness.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

Enable with:

bash

sudo systemctl daemon-reload
sudo systemctl enable --now claws-dream.timer

Linux (cron)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill metadata says the skill is deprecated and retired, but the prompt still instructs the agent to perform broad read/write memory-maintenance operations across MEMORY.md and the memory/ directory. This mismatch can cause unintended file modifications and operational side effects when a user reasonably expects the skill to do nothing except defer to the official built-in feature.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction mandates automatic language detection and requires all output in that language. This creates a locale/language policy issue because it removes user choice and does not document an opt-in or justified constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file contains actionable instructions to immediately create directories and files, scan existing logs, consolidate their contents, and append reports, even though the skill is marked deprecated and retired. That mismatch is dangerous because users may install or invoke a retired skill expecting inert documentation, while it still directs state-changing behavior over local memory data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These instructions direct the agent to create directories and initialize multiple memory files without any explicit consent, dry-run mode, or warning that local data will be modified. Unauthorized or unexpected filesystem writes can overwrite user intent, create misleading records, and expand the skill's persistence footprint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The prompt instructs reading all existing daily logs and extracting decisions, facts, preferences, lessons, and todos into consolidated memory without any privacy notice, minimization rule, or scope restriction. This can silently aggregate sensitive personal or organizational information into a more durable and searchable form, increasing exposure if the memory store is later accessed, synced, or misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template explicitly prompts storage of sensitive categories such as user information, business metrics, team relationships, and technical environment details, but provides no privacy guidance, minimization rules, retention limits, or handling restrictions. In a memory-oriented skill, this increases the chance that operators or downstream agents will persist unnecessary sensitive data and later expose it through prompts, logs, backups, or other memory features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The diagnostic script directly prints memory artifacts from the workspace, including index.json and recent dream-log entries, to stdout without any warning, redaction, or access control. If run in shared terminals, CI logs, bug reports, or support sessions, this can disclose sensitive memory contents, prompts, notes, or other private workspace data beyond what a user may expect from a diagnostic command.

Content

No source excerpt is available for this finding.