Daydreamer

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:03 PM UTC
• Version: 1.0.3

Overview

This skill is mostly transparent about its daydream workflow, but it can read old conversation logs and reuse that private history in persistent memory files and web searches without enough user control.

Review before installing. This skill is not malicious on the evidence inspected, but you should only use it if you are comfortable with old OpenClaw session logs being summarized into persistent workspace files and with daydream cycles potentially turning private memory themes into external web searches. Prefer manual setup, skip or tightly limit seed-memories, inspect proposed memories before writing them, and avoid using it in workspaces that contain secrets, customer data, regulated data, or confidential project names.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: daydream.py:701

Finding

Broad Collection and Persistent Retention of Private Conversation History

Content

View full analysis

= limit: break ``` The corresponding skill instructions direct the agent to process the discovered files: ```markdown python $SCRIPT seed-memories ``` ```markdown The script outputs a list of Claude Code session log files (JSONL) and how many memories are needed. Read each file and extract meaningful events — decisions made, things built, bugs fixed, requests fulfilled, insights gained. Skip heartbeat checks, empty status polls, and trivial exchanges. Write each event as a memory (aim for 50 total): ``` ### Technical Analysis During first-install memory seeding, the script recursively enumerates JSONL files under the user's OpenClaw session directory. It can return up to 20 historical conversation logs and instructs the agent to read them and extract approximately 50 events into `Daydreams.MD`. Historical session logs may contain unrelated private conversations, source code, personal information, operational details, tokens, credentials, or other secrets. The implementation does not: - Restrict collection to the current conversation or task. - Require approval for each discovered file. - Preview extracted memories before persisten ...[truncated 2144 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:379

Finding

Private Memory Content May Be Disclosed Through External Web Searches

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The documented purpose understates materially sensitive behavior: it instructs the agent to scan prior session logs, persist extracted memories, and create additional idea/log files beyond the advertised memory log. This mismatch undermines informed consent and makes operators more likely to invoke the skill without realizing it performs retrospective data mining and durable storage of user-derived content.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · daydream.py (reported line 502)May include surrounding context.

python

if mode == 3:
        prompt_data["target_result_rank"] = random.randint(1, 10)

    return prompt_data


def write_idea_file(synthesis_text, status, state):

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill actively enumerates conversation logs from the user's home directory (~/.openclaw/agents/main/sessions) and surfaces their paths for later reading and extraction into memories. Those logs are likely unrelated to the current task and may contain secrets, private user data, or prior agent outputs; converting them into Daydreams.MD turns ephemeral/private content into persistent derived storage without strong scope checks or consent boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares powerful tools (Read, Write, Edit, Bash, WebSearch) and environment usage, but does not define any explicit scope limits such as allowed paths, permitted commands, or network boundaries. That leaves broad discretion to read workspace files, invoke Python, and perform web access without user-visible guardrails, increasing the chance of unintended data access or misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The design intentionally carries forward full accumulated context through every cycle and stores outputs in logs and idea files, creating broad and repeated retention of user-derived material. Even if the feature is intended, this increases exposure, makes sensitive details propagate into multiple artifacts, and raises the chance of later disclosure or reuse outside the original context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The seeding flow directs the agent to read historical session logs and turn their contents into persistent memories, but it does not warn that prior conversations may contain sensitive, confidential, or regulated data. Without a clear privacy notice and consent step, the skill can silently expand retention and surface old user data in new contexts.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

These instructions explicitly tell the agent to read past session logs and convert meaningful interactions into persistent memory entries. That is a direct retention-and-reprocessing workflow for historical user content, potentially including secrets, personal data, or confidential project details, without strong minimization or consent controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Mode 3 instructs the agent to construct web queries from accumulated context, which may include user-derived memories and prior-session content, yet there is no warning that this context can be transmitted to external search providers. That creates a data exfiltration risk, especially because the accumulated context grows across cycles.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The architecture intentionally carries forward full accumulated context across cycles and later writes synthesized derivatives, cycle logs, and memory trails to persistent files. In a skill designed to ingest memories and possibly external/log-derived content, this repeated forwarding and persistence amplifies any sensitive data exposure across more prompts and more artifacts than necessary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill's declared behavior centers on Daydreams.MD memory maintenance, but finalize also creates standalone files in an ideas/ directory containing synthesized outputs and memory trails. This expands persistence and data distribution beyond the implied storage surface, increasing the chance that sensitive material from memories or logs is duplicated into additional files the user did not expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · daydream.py (reported line 585)May include surrounding context.

python

def cmd_finalize(args):
    """
    Read the synthesis response, write the session log to Daydreamlog.MD,
    update config, and clean up the exchange directory.

    Usage: daydream.py finalize [--forced]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The session-log discovery flow prints out private conversation log paths and instructs the agent to read them, but it does not present a clear user-facing warning that these logs may contain sensitive or unrelated data. Even path disclosure alone can reveal usage patterns or file organization, and the lack of explicit consent increases the risk of unintended privacy violations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code explicitly instructs the agent to read conversation session logs and transform their contents into persistent memories. This creates a direct pipeline from potentially sensitive historical conversations into long-lived artifacts, broadening retention and making accidental inclusion of secrets, proprietary content, or personal data much more likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The help text says --log-dir overrides a default location of ~/.claude/projects, but the implementation actually searches ~/.openclaw/agents/main/sessions when no override is provided. This is an active documentation/code contradiction about what data source the command inspects.

Content

No source excerpt is available for this finding.