Security audit

Autodream

Security checks for vulnerabilities and agentic risk

Overview

This skill is for memory cleanup, but it asks users to run an unaudited external package that can repeatedly rewrite persistent agent memory.

Review this carefully before installing. Prefer a pinned, auditable version, run only dry-run first, inspect proposed memory changes, keep independent backups, avoid the broad "dream" trigger, and do not enable heartbeat writes unless you explicitly want recurring memory changes.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Execution of an Unpinned and Unauditable npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Unaudited External Program Can Destructively Rewrite Persistent Agent Memory
Content: View full analysis
75%) - Prunes stale entries (completed tasks, old debugging notes) - Normalizes relative dates ("yesterday" → "2026-03-24") ### Phase 4: Prune & Index - Enforces max line limit (default: 200 lines) - Prioritizes by importance × recency - Writes clean `MEMORY.md` with category sections - Backs up previous `MEMORY.md` to `memory/.autodream-backups/` ``` ### Technical Analysis The instructions grant an external executable read and write access to persistent Agent memory and explicitly support forced reconsolidation. Its intended operations include pruning entries, imposing a maximum line count, and replacing `MEMORY.md`. The implementation is absent from the audited project. Consequently, the audit cannot verify workspace-path canonicalization, boundary checks, symlink protection, atomic replacement, backup validation, ...[truncated 1295 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: SKILL.md:76
Finding: Persistent Heartbeat Execution of an External Memory-Modifying Program
Content: View full analysis
--stats` to check if consolidation is needed - If "Would trigger: ✅ yes", run `autodream --verbose` - Only run consolidation during quiet hours (not while human is actively chatting) ``` ### Technical Analysis The skill recommends modifying persistent `HEARTBEAT.md` instructions so that the external `autodream` executable is invoked periodically. This turns a one-time memory-maintenance action into recurring, cross-session execution with access to long-term Agent memory. The persistence is disclosed and related to the skill's stated function. However, it amplifies the supply-chain and memory-integrity risks because later executions may occur without a fresh user decision. If the installed package changes, is replaced, or becomes compromised, the persistent heartbeat can repeatedly invoke the affected executable. ### Attack Path 1. The user copies the proposed instructions into `HEARTBEAT.md`. 2. The Agent's heartbeat mechanism periodically executes `autodream --stats`. 3. When the utility reports that its trigger condition is met, the heartbeat invokes the write-capable `autodream --verbose` command. 4. A defective, replaced, or compromised executable gains recurring opportunities to read and modify persistent memory. 5. Altered memory remains available to future sessions and may be modified again during subsequent heartbeat runs. ### Impact Assessment The recurring execution can repeatedly affect the confidentiality, integrity, and availability of workspace memory accessible to the invoking account. It increases the duration and frequency of exposure and may allow malicious or erroneous changes to persist across Agent sessions. The documented behavi ...[truncated 167 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase "dream" is extremely broad and likely to appear in normal conversation unrelated to memory maintenance, creating a substantial risk of accidental skill activation. Because this skill performs file scanning and modifies workspace memory artifacts, unintended invocation could cause unexpected automated changes or consolidation at the wrong time.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manual activation guidance lists ambiguous natural-language phrases, including variants that could overlap with ordinary user speech, which increases the chance the agent invokes this maintenance workflow unintentionally. In context, the risk is amplified because the skill is operational and can rewrite MEMORY.md, prune entries, and normalize content, not merely display information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.