Security audit

Memory Dreaming

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly designed to maintain agent memory, but it gives an unattended agent broad access to transcripts and workspace plans and can persist or sync sensitive information without enough guardrails.

Review this before installing if your OpenClaw transcripts, daily logs, task plans, or Obsidian vault may contain credentials, private URLs, personal information, or sensitive project data. Keep Obsidian sync disabled unless you have a dedicated vault path, add redaction and review steps, and avoid unattended cron use until transcript scope and memory deletion behavior are acceptable.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: references/dream-prompt.md:39
Finding: Persistent Memory Poisoning Through Untrusted Workspace and Session Records
Content: View full analysis
/dev/null | tail -5 # Find sessions with decisions grep -l "let's do\|go with\|use.*instead\|we decided\|the plan is" ~/.openclaw/agents/main/sessions/*.jsonl 2>/dev/null | tail -5 ``` For each file found, grep the specific pattern to extract just the relevant context line. Do NOT read entire session files. ### 2c: Check learnings Read `.learnings/LEARNINGS.md` — note entries with `Status: pending` (especially `Priority: high`). Read `.learnings/ERRORS.md` — note entries with `Status: pending`. ### 2d: Scan for plans Run: ```bash find ~/.openclaw/workspace -name "task_plan.md" -not -path "*/node_modules/*" -not -path "*/skills/*/task_plan.md" 2>/dev/null ``` ``` The gathered content is then persisted by the following instructions at `references/dream-prompt.md:68-80`: ```markdown ## PHASE 3: CONSOLIDATE Update MEMORY.md with gathered signal. Rules: 1. **Don't duplicate** — if a fact already exists in MEMORY.md, skip it ...[truncated 3715 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/architecture.md:47
Finding: Sensitive Transcript Data May Be Duplicated into Plaintext Persistent Storage
Content: View full analysis
/dev/null | tail -5 # Find sessions with decisions grep -l "let's do\|go with\|use.*instead\|we decided\|the plan is" ~/.openclaw/agents/main/sessions/*.jsonl 2>/dev/null | tail -5 ``` For each file found, grep the specific pattern to extract just the relevant context line. Do NOT read entire session files. ``` The resulting memory can be copied into an external vault path at `references/dream-prompt.md:131-140`: ```markdown ### 4b: Knowledge Sync Compare MEMORY.md sections against Obsidian vault: - If MEMORY.md mentions a person with substantial context not in `/People/` → create note - If MEMORY.md mentions a project not in `/Projects/` → create note - If a tool/service was configured and isn't in `/Tools/` → create note Obsidian formatting rules: - Tags on first line before title: `#person #shapes #engineeri ...[truncated 2641 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a substantive autonomous memory-maintenance capability. However, the supplied code only registers a bootstrap-time reminder by appending a virtual markdown file to bootstrapFiles. Its sole behavior is informational: it tells the agent that a memory-dreaming skill exists and references manual commands, a dreaming log path, and an external cron job if configured. None of the described core behaviors—collecting signals, consolidating memory, syncing knowledge, tracking plans, or pruning stale entries—are implemented in this chunk. Additionally, the code is triggered specifically during agent bootstrap, which is not reflected in the declared triggers. This is a material description/behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises autonomous memory consolidation but does not prominently warn that it reads session transcripts and can sync consolidated knowledge to an external Obsidian vault. Because transcripts may contain sensitive data, hidden data-flow to external storage undermines informed consent and increases the chance of inadvertent privacy leakage, especially in a background cron-driven skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manual trigger phrases are broad natural-language commands like "Dream now" and "Sync to obsidian," which can plausibly appear in ordinary conversation or unrelated task discussion. In an agent environment, that can cause unintended activation of a workflow that reads logs/transcripts and may write consolidated data or sync it externally, creating privacy and integrity risks from accidental invocation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill manifest context describes a capability that periodically consolidates logs and transcripts into MEMORY.md, syncs knowledge to an Obsidian vault, tracks plans, and prunes stale entries. This file instead documents only an optional agent:bootstrap hook that reminds the agent about dreaming capabilities, with no indication of consolidation, syncing, or maintenance behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill recommends scanning session transcripts for high-signal patterns and explicitly calls out tracking entities such as URLs and API keys, yet provides no privacy minimization, secret-handling, or exclusion guidance. In this context, the danger is elevated because the skill is a memory-consolidation system: it is designed to persist extracted data into MEMORY.md and optionally sync it into an external Obsidian vault, increasing the chance that secrets or sensitive conversation content are retained and spread.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The architecture explicitly describes creating and updating MEMORY.md, vault notes, plan notes, dashboards, and a dreaming log, but it does not pair these actions with user-consent, scope, or disclosure safeguards. In an agent skill that runs periodically and can sync to an external knowledge base, undocumented write/sync behavior can cause unintended data modification and propagation of sensitive or inaccurate content beyond the local memory store.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The prompt explicitly reads session transcript files from ~/.openclaw/agents/main/sessions/*.jsonl, which reaches outside the workspace memory files and into broader agent-history data. Even though it limits itself to grep matches, this still expands data access to potentially sensitive historical conversations and can expose unrelated secrets or personal information during consolidation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The find ~/.openclaw/workspace -name "task_plan.md" instruction performs broad discovery across the entire workspace rather than a narrowly defined memory-maintenance scope. This can pull in plans from unrelated projects, increasing unintended data exposure and allowing the dream cycle to consolidate or sync information the user did not intend this skill to process.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These instructions direct autonomous modification of MEMORY.md and .learnings/ state, including deletion of stale information and promotion of learnings, without any explicit user-facing warning or confirmation. Because the skill is designed to run unattended on a cron schedule, mistakes or prompt misinterpretation could silently alter long-term memory and lose context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The skill persists and transforms information from daily logs, session transcripts, plans, and learnings into durable memory stores and external notes. That persistence can amplify prompt-injected, stale, or sensitive content by promoting it into MEMORY.md and Obsidian, making accidental or malicious contamination long-lived and harder to detect.
Content: Scanner excerpt · references/dream-prompt.md (reported line 83)May include surrounding context.
md
3. **Absolute dates** — convert any "yesterday", "today", "last week" to actual dates based on the source file's date 4. **Remove stale** — if something references a file that doesn't exist, a task that's done, or a tool that was replaced, remove it 5. **Promote learnings** — for each high-priority pending learning in .learnings/, add the key insight to the appropriate MEMORY.md section and update the learning's status to "promoted" 6. **Be surgical** — only edit sections that actually changed. Don't rewrite the whole file. 7. **Update Active Plans table** — if MEMORY.md has an "Active Plans" section, update it with current plan statuses from the task_plan.md files you scanned ## PHASE 4: SYNC TO OBSIDIAN

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt authorizes creation and updating of external Obsidian vault notes and dashboards, including plan status changes and knowledge-note generation, without clear warning or approval at execution time. This extends write effects beyond the workspace into an external knowledge base, so incorrect inference or poisoned source data could propagate misleading or sensitive information into a user's wider note system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document describes automatic creation and updating of files inside a user’s Obsidian vault, including scanning the workspace for task_plan.md files and updating dashboard notes, but it does not present an explicit warning or consent boundary around modifying user-controlled data. In an autonomous agent skill, silent write behavior to a knowledge base can cause unintended disclosure, corruption of user notes, or propagation of sensitive workspace content into a broader human-accessible vault.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: A memory-maintenance skill is expected to read and write memory-related files, but the prompt operationalizes that through general shell commands for filesystem traversal and text searching across multiple directories. While some file inspection is expected, these instructions provide broader command execution patterns than the manifest itself justifies as core capability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.