Dreaming Guard Pro

• Outcome: Review
• Latest audit: May 28, 2026 · 1:43 PM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with protecting OpenClaw context storage, but it can automatically rewrite, archive, restore, and retain local context data without strong user controls.

Review before installing or enabling automation. Start with read-only health reports, configure the watched paths explicitly, keep separate backups, avoid lossy/aggressive compression unless context loss is acceptable, and do not enable daemon or cron mode until overwrite, restore, retention, and log/report exposure are acceptable.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises operational behavior that reads environment variables and exposes multiple file and process management capabilities, but the manifest does not declare corresponding permissions. Undeclared capability use weakens the trust boundary for users and host platforms because operators cannot accurately assess what the skill may access or modify before installation or activation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose frames the skill as a protective monitor, but the described behavior extends into persistent logging, state storage, backups, report saving, process checks, restart signaling, and scanning workflows. This mismatch is dangerous because users may approve the skill expecting passive monitoring while it performs broader persistence and intervention actions that affect data integrity, privacy, and system behavior.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The document claims 'zero external dependencies' while the architecture explicitly lists third-party packages such as chokidar, archiver, fs-extra, and systeminformation. This is a security-relevant integrity issue because it can mislead reviewers and operators about the true supply-chain and installation footprint of the skill.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The architecture expands from monitoring and context management into process restart and crash-recovery behavior, which materially increases operational power beyond the stated purpose. That scope creep is dangerous because users may install a 'guard' skill expecting file maintenance, not autonomous service control over OpenClaw processes.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The documented ability to 'gracefully restart OpenClaw' is a high-impact control that can interrupt service, affect availability, and potentially be abused if trigger logic is wrong or manipulated. For a context-overflow guard, autonomous restart authority is disproportionate and increases blast radius significantly.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The Healer module proposes PID/liveness checks, recovery-point restoration, and process restart, effectively acting as a watchdog/supervisor rather than a narrow context-management component. This introduces powerful system control that could cause denial of service, restart loops, or unauthorized manipulation of application state if misconfigured or triggered incorrectly.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The code advertises a 'lossless' mode that should preserve all information, but `_filterFields()` drops non-preserved fields and even truncates long string values in `_originalFields` when `targetReduction <= 0.15`. In a context-management or recovery skill, this can silently destroy forensic, debugging, or state data while giving operators false confidence that the archive is safe for restoration.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module advertises crash detection based on gateway process disappearance, but `_findProcess()` does not inspect the real process list and instead returns a value derived from `HEALER_TEST_MODE`. In a recovery/safety component, this creates a dangerous false sense of protection: crashes may go undetected, recovery may never trigger, and operators may trust resilience guarantees that are not actually implemented.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: `restartGateway()` is presented as performing gateway restart, but in production it only logs, emits an event, and returns a simulated success object. This can cause the recovery pipeline to report successful healing even when the gateway remains down, masking outages and breaking availability assumptions for a component whose purpose is self-healing.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document advertises automatic archiving, compression, intervention, and self-healing behavior without an equally explicit warning that these actions may modify data, discard detail, or interrupt service. That omission is dangerous because users may enable the skill without informed consent to destructive or availability-impacting operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic actions such as aggressive archiving, compression, emergency cleanup, and gateway restart, but it does not clearly warn users about possible data loss, irreversible summarization, or disruption to running processes. In an agent skill context, users may install and run this unattended via cron or daemon mode, which increases the risk of unexpected destructive behavior.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes generic terms like 'dreaming', 'OOM', and 'memory protection', which can easily appear in normal conversation and cause unintended activation. In a skill that can archive, compress, and intervene in process behavior, accidental invocation can lead to unwanted data modification or operational changes without deliberate user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes automatic compression, archiving, intervention, and self-healing behavior without a prominent warning that user data may be transformed, moved, or overwritten. In this context, the absence of an explicit warning is especially risky because lossy compression, recovery actions, and emergency handling can alter or destroy user memory/context data and may be triggered automatically.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The restore routine writes recovered files directly to the target path using paths from the manifest and fs.createWriteStream, with no check for whether the destination already exists and no confirmation/overwrite policy. In this skill's context, the module operates on memory/archive data under user home directories, so silent overwrite can destroy current state or replace important files if restore is pointed at an active workspace.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module will execute externally injected handlers for actions such as archive, compress, or emergency cleanup with no built-in authorization, confirmation, policy gate, or restriction based on action severity. In this skill’s context, those actions are explicitly designed to modify or delete data under storage pressure, so a caller that can register or trigger handlers can cause destructive operations without any user-facing safeguard.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The manual compression entry point directly invokes lossy compression on the configured watch path without any confirmation, dry-run, safeguard, or policy check at this call site. In a tool whose purpose is to automatically manage and mutate stored context data, this increases the risk of accidental irreversible data loss or corruption if the method is called programmatically, misused by another component, or exposed through a higher-level interface.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The architecture proposes archiving, indexing, retention, and search across dreaming/context data without specifying minimization, redaction, encryption, or access controls. Because dreaming data may contain sensitive user context, persistent searchable storage increases confidentiality risk and makes accidental disclosure or over-retention more likely.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The Reporter and Logger designs describe continuous reporting of workspace names, sizes, actions, and potentially contextual details, which can expose sensitive user information through logs or health reports. Without sanitization and access restrictions, logs become a secondary data leakage channel even if the primary data store is protected.

Static analysis

No suspicious patterns detected.