ClawHub
Back to skill

Security audit

dream-memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is not deceptive or destructive, but it needs review because it can persist and index user/session memory with limited consent, retention, and scoping controls.

Install only if you intentionally want cross-session memory. Before using it with private work, decide what may be stored, avoid indexing secrets or sensitive personal data, restrict memory search to the intended workspace or agent, review any session data access under ~/.openclaw, and verify the Ollama installer instead of blindly running the curl-to-shell command.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill advertises only documentation and memory-management guidance, yet static analysis detected shell-capable behavior without declared permissions. Undeclared execution capability is dangerous because it can enable local probing or command execution beyond user expectations, weakening permission boundaries and auditability.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
There is a clear description-behavior mismatch: the skill claims to explain or manage workspace memory, but the analyzed behavior includes local service probing, model-installation checks, and reading user-home configuration. This is risky because users may invoke it for benign documentation purposes while it performs host-environment inspection outside the expected workspace scope.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The instructions tell the agent to read per-agent session state from ~/.openclaw/agents/{agent-id}/sessions/sessions.json, which extends access from workspace memory files into the user's home directory. Accessing cross-session metadata outside the workspace increases privacy risk and can expose unrelated agent history or sensitive local state not necessary for ordinary memory documentation.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# macOS / Linux
curl -fsSL https://ollama.com/install.sh | sh

# 下载 bge-m3 模型
ollama pull bge-m3
Confidence
98% confidence
Finding
The documentation instructs users to fetch and immediately execute a remote shell script via `curl ... | sh`, which bypasses review of the downloaded content and creates a supply-chain risk. If the remote server, transport, DNS, or hosting account is compromised, users could execute arbitrary code on their machine with the privileges of the shell.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# macOS / Linux
curl -fsSL https://ollama.com/install.sh | sh

# 下载 bge-m3 模型
ollama pull bge-m3
Confidence
97% confidence
Finding
Piping network output directly into `sh` is dangerous because it chains retrieval and execution into a single unreviewable step. In this skill context, the content is operational setup guidance for local agent infrastructure, so readers are likely to copy-paste commands verbatim, increasing the chance of immediate arbitrary command execution if the upstream content is altered.

Static analysis

No suspicious patterns detected.