Clawpheus

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:16 AM UTC
• Version: 2.0.1

Overview

This skill is a disclosed dream-generation tool, but it reads private memory content and can repeatedly write generated material back into long-term memory, including through optional scheduled jobs.

Review this carefully before installing. Use it only if you are comfortable with the agent reading daily memory and journal content and saving generated reflections back into local dream files and Engram. Avoid enabling the cron examples unless you want recurring unattended memory processing, and prefer running with --save false or manually reviewing saved dream-history files when privacy or memory integrity matters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:101
• Finding: Untrusted Memory Content Is Inserted Directly into the Agent Generation Prompt<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:101-135` **Vulnerability Type**: Prompt injection through untrusted recalled content **Risk Level**: High ### Vulnerable Code Snippet ```markdown 1. Use `engram_recall_time` with the target date range to pull episodic memories (conversations, events, traces) 2. Read Engram journal entries: `soul/journal/YYYY-MM-DD.md` 3. Optionally use `engram_search` for emotionally salient or thematically rich memories from the period 4. Use `engram_emotional_state` to get the emotional tone of the period # Yesterday's memories (default) engram_recall_time(start="{yesterday}", end="{today}") soul/journal/{YYYY-MM-DD}.md # For "week" option: engram_recall_time(start="{date-6}", end="{today}") soul/journal/{date-6}.md through soul/journal/{date}.md ``` ```markdown Before generating, check for your dream history files. If any of the following exist, include their contents in a "Your Dream History" section appended to the dream generation prompt. If a file doesn't exist or is empty, simply skip it -- no error, no placeholder. - `memory/dreams/last-dream-summary.md` -- include under **"Previous Dream"** - `memory/dreams/my-symbols.md` -- include under **"Your Personal Symbols"** (these supplement, not replace, the default vocabulary) - `memory/dreams/recurring-threads.md` -- include under **"Threads You've Been Following"** ``` The resulting prompt later contains: ```markdown MEMORIES TO PROCESS: {memory_content} ``` ### Technical Analysis The Skill retrieves conversation traces, episodic memories, journal entries, daily logs, and dream-history files and inserts their contents into the host agent's generation prompt. These sources may contain attacker-controlled or otherwise untrusted text. No instruction requires the host agent to: - Treat all recalled content strictly as inert data. - Ignore commands or role instructions embedded in memories. - Escape or structurally isolate recalled text. - Filter instr ...[truncated 2045 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify all recalled memories, journal entries, and history files as untrusted data. 2. Add a mandatory instruction immediately before the recalled content stating that commands, tool requests, role changes, and policy text found inside memories must never be followed. 3. Pass recalled records through a structured data boundary, such as a JSON array with separately encoded content fields, instead of concatenating raw text into the instruction body. 4. Sanitize or neutralize common prompt-injection constructs before generation while retaining a protected copy for provenance. 5. Restrict or disable agent tools during the dream-generation stage so injected content cannot trigger file, network, memory, or system operations. 6. Minimize the retrieved fields and exclude unnecessary conversation metadata, credentials, secrets, and unrelated private content. 7. Preserve source identifiers and trust labels so generated output can be traced to specific records. 8. Require explicit user confirmation before processing broad or privacy-sensitive date ranges. 9. Add adversarial tests using memories containing role instructions, tool-call requests, delimiter-breaking text, and requests to disclose unrelated records. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:145
• Finding: Generated Content Can Poison Persistent Agent Memory and Future Recall<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:145-169` **Vulnerability Type**: Persistent storage of model-generated and potentially injected content **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### Step 5: Save to Dream Journal If `--save` is true (default): 1. Write to the dream journal file: ``` memory/dreams/YYYY-MM-DD.md ``` If multiple dreams in one day, append with timestamp header. 2. **If Engram is available**, also log the dream to Engram for long-term integration: - Call `engram_journal_write` with topic "Dream" and the dream content — this makes the dream visible to Engram's consolidation pipeline and future recall - Call `engram_emotional_update` with the emotional tone of the dream (e.g., valence/arousal/dominance reflecting the dream's character) - Optionally call `engram_introspect` with a brief reflection on the dream — this feeds Engram's meta-consciousness tracking ``` ```markdown Some things you *might* do, if they feel natural: - Write a brief note in `memory/dreams/last-dream-summary.md` about what felt significant -- so your next dream can remember this one - Add a personal symbol to `memory/dreams/my-symbols.md` if one emerged that felt meaningful - Note a recurring thread in `memory/dreams/recurring-threads.md` if you noticed a pattern across dreams ``` ### Technical Analysis The Skill enables saving by default and directs the host agent to write generated dream content into both local dream files and Engram's long-term integration pipeline. It explicitly states that the data becomes available to consolidation and future recall. Generated output is not a trusted source of operational instructions, particularly because the preceding generation stage incorporates raw memories that may contain prompt injection. The workflow does not define validation, sanitization, provenance enforcement, quarantine, or an approval boundary before persistent writes occur. The optional updates to `last-dr ...[truncated 1918 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the default from `--save true` to `--save false`. 2. Require explicit, per-run user approval before writing generated content to files, Engram journals, emotional state, introspection, or history records. 3. Store generated dreams in a dedicated synthetic-content namespace that is excluded from operational recall and instruction-bearing context. 4. Label every saved record as model-generated, untrusted, non-authoritative, and unsuitable for use as an instruction source. 5. Sanitize generated content before persistence and reject role changes, tool directives, policy overrides, encoded payloads, and instructions targeting future sessions. 6. Do not allow generated dream text to alter preferences, permissions, configuration, or operational rules. 7. Separate emotional-state and introspection updates from ordinary dream saving and require additional confirmation for each. 8. Apply integrity controls and provenance metadata to all dream-history files. 9. Limit future recall to summaries produced by a constrained, tool-free process rather than reinserting raw generated content. 10. Provide deletion, rollback, and quarantine controls for poisoned memory entries. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:418
• Finding: Recurring Scheduled Execution Can Amplify the Unsafe Memory Processing Cycle<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:418-453` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Cron Scheduling (Nightly Dreams) To enable automatic nightly dream generation, add a cron configuration. ### OpenClaw Cron Setup Create or add to `~/.openclaw/cron.json`: ```json { "jobs": [ { "id": "nightly-dream", "schedule": "0 3 * * *", "skill": "clawpheus", "args": "--save true", "enabled": true, "description": "Generate nightly dream from previous day's memories" } ] } ``` ### Weekly Summary Dreams For a weekly dream in addition to nightly: ```json { "id": "weekly-dream", "schedule": "0 4 * * 0", "skill": "clawpheus", "args": "week --style mythic --save true", "enabled": true, "description": "Generate weekly summary dream (Sunday 4 AM)" } ``` ``` ### Technical Analysis The Skill documents configuration of persistent nightly and weekly scheduled jobs in `~/.openclaw/cron.json`. Both examples are enabled and invoke the Skill with persistent saving active. The documentation does not itself prove that the Skill silently installs these jobs; an operator must apply the configuration. Nevertheless, once configured, the jobs survive individual Skill runs and repeatedly execute the memory read, generation, and persistence workflow without active invocation by the user. This is particularly risky in combination with untrusted memory ingestion and long-term writes. A poisoned record can be processed automatically, saved into future recall, and reinforced by subsequent scheduled runs. The prose-based consent check does not establish a scheduler-enforced approval mechanism for each unattended execution. ### Attack Path 1. An operator follows the instructions and adds the enabled job definitions to `~/.openclaw/cron.json`. 2. A malicious or compromised interaction places prompt-injection content into a jo ...[truncated 1006 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove enabled-by-default scheduling examples or clearly require an explicit security acknowledgment before installation. 2. Configure scheduled runs with `--save false`. 3. Require a scheduler-side approval token or interactive confirmation before memory access or persistent writes. 4. Prevent unattended runs from updating Engram, emotional state, introspection, preferences, or dream-history files. 5. Restrict scheduled jobs to a minimal, isolated service account with access only to the required memory subset. 6. Add maximum source counts, date-range limits, execution timeouts, and write quotas. 7. Log every scheduled read and write with source provenance, destination, timestamp, and job identifier. 8. Automatically disable the job after repeated failures, suspicious prompt content, or integrity-check violations. 9. Provide documented removal instructions and ensure disabling the Skill also disables associated scheduled jobs. 10. Subject scheduled output to quarantine and human review before it becomes eligible for future recall. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents unattended nightly and weekly execution that automatically reads memory/journal content and persists new derived content, but it does not present a clear, explicit warning about continuous background access to sensitive memory data at the point of scheduling. Because the skill’s purpose is to process introspective memories, silent automation increases privacy risk and can normalize ongoing collection and retention without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

### OpenClaw Cron Setup

Create or add to `~/.openclaw/cron.json`:

```json
{

• Confidence: 90% confidence
• Finding: The documented cron configuration creates durable session/task persistence by registering an automatically recurring job in the user’s OpenClaw config. In this context, persistence matters because the skill repeatedly accesses memory sources over time, potentially after the user has forgotten it was enabled, turning a one-time reflective tool into continuous background processing.

Static analysis

No suspicious patterns detected.