Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clawpheus
v2.0.1Generate AI dream sequences from previous day's memories for cross-model reflection and introspection
⭐ 0· 650·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (generate dream sequences from previous memories) matches the instructions' stated behavior. However, the skill assumes access to agent memory and an 'Engram' recall/search/emotional API; the registry metadata declares no config paths or required tools. That omission is unexpected but could be explained if these are standard agent capabilities.
Instruction Scope
SKILL.md explicitly instructs the agent to read private journal/memory files (e.g., soul/journal/YYYY-MM-DD.md) and to write generated dreams and preferences to memory/dreams/*.md. It also references using internal functions (engram_recall_time, engram_search, engram_emotional_state). Those file reads/writes and internal-tool calls are broader than the metadata advertises and involve persistent access to potentially sensitive user data; the instructions also include self-modification of preference files (including disabling the skill) which increases the persistence surface.
Install Mechanism
No install spec and no code files are present (instruction-only). That minimizes supply-chain risk: nothing is downloaded or written by an installer.
Credentials
The skill requests no environment variables or external credentials, which is consistent with 'no external calls.' However, it implicitly requires file system read/write access to memory/journal paths and access to Engram APIs. Those privileges are not declared under required config paths in the metadata, producing a proportionality mismatch between declared requirements (none) and actual runtime needs (private file and internal-api access).
Persistence & Privilege
always:false and normal autonomous invocation are fine. The skill intends to persist user preferences and generated dreams to agent memory (memory/dreams/preferences.md and YYYY-MM-DD.md). Persisting user preferences and content is reasonable for this purpose, but it does give the skill a lasting footprint in agent memory and the ability to toggle its own enabled flag if file access exists.
What to consider before installing
This skill will read and write private journal/memory files and use internal memory/Engram functions, but the registry metadata doesn't declare those file paths or tools. Before installing, confirm that: (1) you are comfortable with a skill reading your journal entries and storing generated dreams in your agent memory, (2) your agent exposes the referenced Engram APIs and memory paths and you trust them, and (3) you understand that the skill will persist user preferences (including optionally writing an enabled:false flag). If you want to proceed, consider testing in a sandboxed agent or backing up your memory/journal files first. If you cannot verify or restrict its file access, treat this installation as higher-risk.Like a lobster shell, security has layers — review code before you run it.
dreamvk978rnyre5kx4hybdegzv1wm9s80rbb1latestvk975n2hxhhkxfs02mn799r2peh822pyc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌙 Clawdis
OSmacOS · Linux · Windows