Security audit

SQL Dreamer

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for SQL-backed OpenClaw memory dreaming, but it needs Review because it runs scheduled jobs over persistent memories, database credentials, deletion, and optional external publishing with some important security controls under-specified.

Install only if you are comfortable giving this skill scheduled access to your OpenClaw workspace and SQL memory database. Before production use, remove or override TrustServerCertificate=yes, use a least-privilege SQL account, verify backups before enabling file cleanup, keep tokens and .env/config files out of source control, and enable Confluence publishing only after reviewing page permissions and redacting sensitive memory content.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: src/sql_connector.py:91
Finding: SQL Server certificate validation is explicitly bypassed
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/pre_dream_sql_feed.py:48
Finding: Database-controlled content is copied verbatim into persistent Agent memory input
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Dependencies are not reproducibly pinned and the network client dependency is undeclared
Content: View full analysis
=4.0.0 PyYAML>=6.0 ``` The optional publisher additionally imports a dependency that is absent from the requirements file: ```python import requests ``` ### Technical Analysis The dependency constraints specify only minimum versions and have no upper bounds, lock file, or package hashes. Consequently, separate installations may retrieve different versions, including future versions that were never reviewed with this Skill. The Confluence publisher imports `requests`, but `requests` is not declared in `requirements.txt`. Its behavior therefore depends on whether an unrelated environment has already installed that package and which version is present. This creates the following risks: - Non-reproducible deployments. - Silent adoption of future dependency releases. - Continued use of an old or vulnerable preinstalled `requests` package. - Publisher failure in a clean environment. - Increased supply-chain exposure during recurring rebuilds or installations. The reviewed dependency names do not show direct evidence of typosquatting or a known malicious source. The issue is inadequate version and integrity control rather than confirmation that a listed package is malicious. ### Attack Path 1. A user installs the Skill using `pip install -r requirements.txt`. 2. The package resolver selects any available versions satisfying the broad minimum constraints. 3. A future compromised, malicious, or incompatible release can be selected without a project code change. 4. The Skill imports and executes the selected package in processes that handle SQL credentials, database records, and workspace memory. 5. For the Confluence publisher, the environment may supply an arbitrary preinstalled `requests` version because no reviewed version is declared. 6. If a selected ...[truncated 808 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (32)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · GETTING_STARTED.md (reported line 64)May include surrounding context.
bash
cd ~/.openclaw/workspace # Or wherever your OpenClaw workspace is cp .env.example .env

Edit .env and add SQL Server credentials:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · GETTING_STARTED.md (reported line 231)May include surrounding context.
python
from sql_connector import get_connector db = get_connector() # Uses credentials from .env # That's it. You can now query SQL Server.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · GETTING_STARTED.md (reported line 233)May include surrounding context.
python
from sql_connector import get_connector db = get_connector() # Uses credentials from .env # That's it. You can now query SQL Server.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL_REFERENCE.md (reported line 88)May include surrounding context.
python
from sql_connector import get_connector db = get_connector() # Uses credentials from .env # That's it. You can now query SQL Server.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL_REFERENCE.md (reported line 207)May include surrounding context.
python
from sql_connector import get_connector db = get_connector() # Uses credentials from .env # That's it. You can now query SQL Server.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · tests/test_pre_dream_sql_feed.py (reported line 18)May include surrounding context.
python
irname(os.path.abspath(__file__)))) from scripts.pre_dream_sql_feed import build_memory_content, run SAMPLE_MEMORIES = [ {"id": 1, "category": "facts", "key_name": "ob342_complete", "content": "Memory palace configured with OB-342.", "importance": 9, "created_at": datetime(2026, 4, 25, 12, 0, tzinfo=timezone.utc)}, {"id": 2, "category": "facts", "key_name": "crontab_fixed", "content": "Crontab corrected with OB-343.", "importance": 8, "created_at": datetime(2026, 4, 25, 13, 0, tzinfo=timezone.utc)}, {"id": 3, "category": "lessons_learned", "key_name": "rule2_enforcement", "content": "Always branch before committing.", "importance": 7, "created_at": datetime(2026, 4, 25, 14, 0, tzinfo=timezone.utc)}, {"id": 4, "category": "facts", "key_name": "low_importance", "content": "Should not appear in corpus.", "importance": 3, "created_at": datetime(2026, 4, 25, 15, 0, tzinfo=timezone.utc)}, ] class TestBuildMemoryContent: def test_returns_string(self): result =

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · GETTING_STARTED.md (reported line 20)May include surrounding context.
md
│ │ SQL Memory (clawbot-sql-memory) │ │ │ │ ├─ Stores: facts, decisions, incidents, lessons learned │ │ │ │ ├─ Table: memory.Memories │ │ │ │ └─ Uses: SQL Connector to read/write │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ↓ (daily at 3:00 AM) │ │ ┌──────────────────────────────────────────────────────────┐ │

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly describes optional Confluence publishing of dream reports to an external service but does not warn that agent-generated memories, reports, or potentially sensitive internal content may be transmitted outside the local environment. In this context, users may enable the feature without understanding the data-sharing implications, creating a real risk of unintended data exfiltration or privacy/compliance violations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · GETTING_STARTED.md (reported line 219)May include surrounding context.
Configure SQL Dreamer

Create configuration file:

bash
cd ~/.openclaw/workspace

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly advertises automatic pruning of dream output files older than N days, but does not give a clear warning that this permanently deletes local artifacts and may remove data needed for audit, recovery, or troubleshooting. In a scheduled unattended workflow, users may enable the feature without realizing the retention and backup implications, leading to unintended data loss.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · GETTING_STARTED.md (reported line 291)May include surrounding context.
Crontab Integration

Add these entries to your crontab (crontab -e). Adjust timezone as needed (shown in EDT = UTC-4):

cron
# Pre-dream SQL feed: populate clean memory file from SQL (30 min before dream cycle)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 166)May include surrounding context.
Crontab Integration

Add these entries to your crontab (crontab -e). Adjust timezone as needed (shown in EDT = UTC-4):

cron
# Pre-dream SQL feed: populate clean memory file from SQL (30 min before dream cycle)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill performs file pruning of dream outputs, but the top-level description does not prominently warn that it deletes files. In an automation context with cron and a configurable workspace path, under-documented destructive behavior increases the risk of accidental data loss or deletion of the wrong files if the path or retention settings are misconfigured.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation presents optional Confluence publishing without clearly warning that dream outputs may be transmitted to an external service. Because the skill handles session logs, memories, and synthesized outputs, operators may unknowingly export sensitive or private content outside the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly encourages storing 'facts/decisions/incidents' and dream synthesis outputs in SQL tables and markdown files, which can reasonably contain sensitive organizational or personal information. There are no warnings about data minimization, classification, retention, access controls, or user consent, so adopters may persist sensitive data in places that are broadly accessible or retained longer than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Confluence configuration documents publishing dream data to an external SaaS destination but provides no warning that the content may include sensitive internal memories, incident data, or derived insights. This omission increases the chance of accidental data exfiltration to a broader audience, especially if users enable publishing without understanding visibility and data handling implications.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL_REFERENCE.md (reported line 449)May include surrounding context.
md
- Run `pre_dream_sql_feed.py` manually and check output **"Cron jobs not running"** - Check crontab: `crontab -l` - Check logs: `tail ~/.openclaw/logs/pre_dream.log` - Run scripts manually to see errors

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest explicitly states that dream output .md files older than a configured age will be deleted, but it does not prominently warn users that enabling or using the skill causes destructive filesystem behavior. In the context of a memory/archive skill, silent cleanup can lead to unintended data loss, especially if users assume the skill only archives to SQL and do not realize local files are purged afterward.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The stated skill purpose focuses on replacing file-based memory ingestion with SQL queries and archiving dream outputs to SQL while keeping the filesystem lean. Adding a separate Confluence publishing capability introduces an external content publication feature that is not justified by that stated purpose.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/confluence_dream_publisher.py (reported line 108)May include surrounding context.
python
"space": {"key": space_key}, "body": {"storage": {"value": body, "representation": "storage"}}, } r = requests.post(f"{self.base_url}/content", headers=self.headers, json=payload) r.raise_for_status() return r.json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/confluence_dream_publisher.py (reported line 120)May include surrounding context.
python
"version": {"number": version + 1}, "body": {"storage": {"value": body, "representation": "storage"}}, } r = requests.put(f"{self.base_url}/content/{page_id}", headers=self.headers, json=payload) r.raise_for_status() return r.json()

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script deletes all existing DreamLight rows for the selected cycle_date, which is a destructive operation affecting persisted data. Although the file includes general docstrings and prints status output, it does not clearly warn the user before execution that prior database entries for that date will be removed and replaced.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring frames the script's purpose narrowly as reading JSON phase-signal state and UPSERTing it into dreams.PhaseSignals as a backup/audit copy. However, the implementation also parses daily-ingestion.json and writes activity records into dreams.DreamCorpus, which is a separate behavior not reflected in that documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions tell users to create a .env file containing database credentials but do not warn them to protect that file from source control, logs, backups, or overly permissive filesystem permissions. This is a genuine secret-handling weakness in setup documentation because it normalizes storing live credentials without accompanying safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation states that dream files are deleted after 7 days but does not clearly call out that this is a destructive retention policy. Users may unintentionally lose audit, debugging, or historical artifacts they expected to preserve, especially in production or incident-review contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T02 · Agent Memory Poisoning

T08 · Insecure Dependencies

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Session Persistence

Missing User Warnings

Session Persistence

Configure SQL Dreamer

Missing User Warnings

Session Persistence

Crontab Integration

Session Persistence

Crontab Integration

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

Missing User Warnings

Context-Inappropriate Capability

External Transmission

External Transmission

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Static analysis