Soft Pillow - Sleep & dream journal

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill appears to be a straightforward read-only Soft Pillow connector, but it will use your API key to read private sleep and dream records.

Install only if you are comfortable giving the agent read access to your Soft Pillow sleep and dream history. Prefer a revocable API key, limit the queries you ask for, and revoke the key when you stop using the skill.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone or any agent workflow using that key can read the user's Soft Pillow sleep and dream records through the documented API.

Why it was flagged

The skill requires a user-provided Soft Pillow API key that can read the user's account data. This is disclosed and purpose-aligned, but it is still account-level delegated access.

Skill content
get an api key from the settings screen and give it to you so you can access all of the data
Recommendation

Use a dedicated/revocable API key, provide it only if you want the agent to access this data, and revoke it from the app settings when no longer needed.

What this means

Your dreams, notes, mood, sleep disruptions, timestamps, and related activity details may appear in the agent conversation or outputs.

Why it was flagged

The skill can retrieve private journal-like sleep and dream details into the agent context. This is central to the skill's stated purpose, but the content is sensitive personal information.

Skill content
Returns summary + details (`dream`, `notes`, `disruptions`, `insights`, timestamps).
Recommendation

Ask for only the entries or date ranges you need, avoid using this in shared sessions, and do not expose results beyond your intended audience.