Security audit

signal-dreaming

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed memory-consolidation skill that edits workspace memory files and backups; the main risk is that scheduled or manual runs can rewrite persistent memory.

Install only if you want an agent to curate and rewrite your workspace memory. Use the explicit prompt or a carefully reviewed schedule, keep backups, and add your own stricter privacy rules if daily logs may contain sensitive non-credential information you do not want promoted into MEMORY.md or topic files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a skill whose main function is to consolidate session logs into topic files and a compact MEMORY.md index across bounded phases with guards. The supplied code is instead a standalone shell audit script. It reads existing files, computes size/headroom metrics, checks for required files, counts dream-log entries, reports backup directory counts/size, and performs a regex-based secret scan. While the secret-guard aspect partially aligns, the script does not perform the core declared behavior of consolidating logs, updating L2 topic files, generating MEMORY.md, or executing the described phased workflow. This is a material purpose/behavior mismatch, not just an implementation detail difference.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
Full release history, with the reasoning behind each change: `references/changelog.md`.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The secret-handling rule is dangerously narrow because it says the list is exhaustive and instructs the agent not to extend it by judgment. That can cause the agent to propagate sensitive material not matching the listed patterns—such as session identifiers, internal bearer artifacts, connection strings, webhook secrets, or other credential forms—into MEMORY.md, L2 files, or dream-log.md, where they become durable and easier to exfiltrate.
Content: Scanner excerpt · references/dream-protocol.md (reported line 235)May include surrounding context.
md
- API keys, tokens, OAuth strings, cookies, private keys - passwords, invite/player/server passwords, recovery codes - signed URLs or URLs containing access tokens - private SSH keys or full credential-bearing command lines **Do not extend the list on your own judgement.** This guard covers authentication material. It is not a privacy classifier and deliberately does not attempt to be one — content that is not on the list is consolidated under the workspace's own conventions, exactly like the rest of the log.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation phrase "run a dream consolidation" is broad enough that an unrelated user message or automated workflow could trigger memory-processing behavior without a strong confirmation boundary. In this skill's context, activation leads to reading and rewriting memory-related files, so accidental invocation could cause unintended modifications to curated memory, backups, or summaries even if the protocol contains some path and secret guards.
Content: No source excerpt is available for this finding.

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Content: Scanner excerpt · references/changelog.md (reported line 234)May include surrounding context.
md
**Entries are placed deliberately.** New entries were appended to the end of the file, which is not a neutral position — it sits under whatever heading happens to be last. An active project entry landed under a standing-rules heading in production, where later runs would have read it as a permanent rule and never considered it for consolidation again. Phase 3.2 now assigns a section before writing, and Phase 3.6 checks that every entry sits under a heading matching what it is.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/dream-protocol.md (reported line 17)May include surrounding context.
md
1. **Fail soft, report loudly.** If something is wrong but memory is not at risk, do the work you can do, then say plainly what you skipped and why. A dream that consolidates 3 of 4 topics and reports the fourth is a success. A dream that refuses to start is not. 2. **Never let a diagnostic block the main job.** Audits, size checks, and sanity scans exist to inform the final report. None of them is a precondition for consolidating memory. 3. **Only two things justify stopping before writing:** a failed backup (Phase 2.0 / Phase 3.1), or a write plan that reaches outside the allowed paths — and the second cancels only those targets, not the run. Everything else is a note in the summary. The one hard stop that *is* real: **never write a secret into curated memory.** That guard blocks the specific value, not the run.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/dream-protocol.md (reported line 153)May include surrounding context.
md
**An empty selection is a valid outcome, and it ends the run.** This state used to be reachable only through the guardian, because a run always had at least the watermark date to re-read. Now that the watermark date contributes only its changed files, a run can legitimately select nothing — including a manual trigger, which bypasses the guardian by design. When that happens: write nothing at all, leave the watermark exactly where it is, and report a no-op. **Phase 1 stays read-only here as everywhere else.** The guardian writes a `SKIP` line because the diary is its only way to say anything; a run that got as far as Phase 1 has its final summary instead, and nothing in this protocol reads those comments — Phase 1.1 anchors on Dream headings, never on a `SKIP`. Do not widen the range looking for work, and **do not write a dream-log entry carrying `Consolidated through:`**. Re-stating a watermark for logs nothing was read from records a consolidation that did not happen, and the field is the one thing a later run trusts without checking. ### 4. Identify L2 update candidates

Static analysis

No suspicious patterns detected.