DreamCycle

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:56 AM UTC
• Version: 0.1.0

Overview

DreamCycle is a coherent log-analysis helper, but users should treat its session-log access and unpinned external CLI install with care.

Install in a virtual environment, review the package/source before use, and run it only on approved session directories. Avoid scanning logs that may contain secrets unless you have redacted them, and periodically review or delete `~/.dreamcycle/scan_history.json` if retention is not desired.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–52
Vulnerability Type: Supply-chain risk from an unpinned dependency
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
pip install dreamcycle

text

### Technical Analysis

The Skill directs users to install the mutable `dreamcycle` package from the package index configured for `pip`. It does not specify an exact version, verify a cryptographic hash, identify a trusted publisher, or include reviewable package source in the audited artifact.

Consequently, the code that is installed and subsequently exposed through the `dreamcycle` executable cannot be verified from this project. A compromised package release, package-index account, configured mirror, or dependency could introduce arbitrary code. Package installation hooks or later execution of the installed command could run that code with the privileges of the invoking user.

The artifact does not establish that the current package is malicious. The vulnerability is the absence of dependency pinning and integrity verification before installing and trusting externally supplied executable code.

### Attack Path

1. An attacker compromises the package publisher, package-index account, distribution channel, or a package dependency.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented `pip install dreamcycle` instruction.
4. `pip` resolves and installs the attacker-controlled or compromised release because no version or hash is pinned.
5. Malicious code executes during installation, import, or invocation of the `dreamcycle` command.
6. The code operates with the invoking user's permissions and can access resources available to that account.

### Impact Assessment

Successful exploitation could permit arbitrary code execution as the user performing the installation or running the CLI. The potential scope includes
...[truncated 197 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed, exact version rather than installing an unconstrained release.
• Publish and verify cryptographic hashes, such as through a requirements file used with pip --require-hashes.
• Include the relevant source code in the Skill or link it to an immutable, signed release that can be independently audited.
• Clearly identify the expected package registry, project owner, and trusted publisher.
• Use a dedicated virtual environment and a non-privileged account for installation and execution.
• Review the complete dependency tree and use automated dependency and provenance checks.
• Consider disabling network access and limiting filesystem access when executing the scanner.

other

Warning

• Location: SKILL.md:56

Finding

Unaudited Third-Party CLI Is Granted Access to Sensitive Agent Session Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–63
Vulnerability Type: Sensitive session-log exposure
Risk Level: Medium

Vulnerable Code

markdown

## Usage

```bash
# Basic diagnostic: scan last 2 days of sessions
dreamcycle diagnose ~/.openclaw/sessions/

# Scan last 7 days
dreamcycle diagnose ~/my-agent/logs/ --days 7

text

The expected sensitive content is further described at lines 106–108:

```markdown
- Session files must be JSON format with a `messages` array containing
  `role`/`content` fields

Technical Analysis

The documented commands grant the externally installed dreamcycle executable read access to directories containing AI-agent session logs. The required messages array includes conversation roles and content, which may contain user information, prompts, secrets, credentials accidentally included in conversations, tool output, internal paths, or other operational data.

This project contains no implementation source with which to verify data minimization, local-only processing, secret redaction, or the absence of network transmission. It also does not instruct users to review or sanitize logs before processing them.

The artifact does not prove that DreamCycle transmits or maliciously uses session data. The risk arises from directing an unaudited third-party executable to process potentially sensitive records without documented isolation or privacy controls.

Attack Path

1. A user installs the externally supplied package as documented.
2. The user invokes dreamcycle diagnose against an agent session directory.
3. The executable reads JSON messages content under the invoking user's filesystem permissions.
4. If the installed implementation is compromised or behaves unexpectedly, it can collect sensitive conversation content.
5. Without network isolation or verified local-only behavior, that implementation could disclose the collected da ...[truncated 606 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle or otherwise provide the scanner's complete reviewable source code.
• Document whether processing is entirely local and identify every possible network interaction.
• Default to network-denied execution and restrict filesystem access to explicitly selected input files.
• Prompt users for informed confirmation before reading session directories.
• Implement secret detection and redaction before analysis or persistence.
• Minimize collected fields and avoid retaining raw message content when aggregate statistics are sufficient.
• Ensure any scan-history file contains only sanitized aggregate data and is created with restrictive permissions.
• Recommend execution in a sandbox, container, or dedicated non-privileged environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly instructs users to scan session logs and persist trend history, but it provides no warning about sensitive data that may be present in logs or how that stored history should be protected. Session logs commonly contain prompts, secrets, file paths, tokens, internal reasoning traces, or personal data, so normalizing collection and retention without privacy guidance increases the likelihood of unintentional data exposure or over-retention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.