dream-memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent memory-system guide, but its setup and runtime guidance include review-worthy risks around remote installer execution, broad local service CORS, and persistent session-memory access.

Review this skill before installing. Use safer Ollama installation steps instead of piping a downloaded script directly to sh, restrict OpenViking CORS to trusted origins or disable it, and only enable the memory system if you are comfortable with persistent workspace/home-directory memory data and session metadata being read and indexed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/ollama-setup.md:7

Finding

Unverified Remote Installer Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: references/ollama-setup.md:7
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# macOS / Linux
curl -fsSL https://ollama.com/install.sh | sh

Technical Analysis

The installation instructions download a mutable script from an external server and immediately execute it with sh. The script is not pinned to a release, saved for inspection, checked against a cryptographic hash, or verified using a publisher signature.

HTTPS provides transport protection but does not establish that the retrieved script is the same payload that was reviewed. A compromise of the website, CDN, publishing process, DNS or certificate infrastructure could cause arbitrary replacement code to be executed. The use of curl -fsSL also suppresses normal output and follows redirects, which reduces visibility into the final source and behavior.

Direct execution of a remote script exceeds the minimum privileges and trust required to document or configure a local memory system. A pinned package or separately verified artifact can provide the required Ollama dependency without treating a mutable network response as trusted shell code.

Attack Path

1. An attacker compromises the installer endpoint, its deployment pipeline, CDN, or another relevant delivery component.
2. The attacker replaces the expected installer or redirects the request to an altered payload.
3. A user follows the Skill documentation and runs the provided command.
4. curl retrieves the attacker-controlled response and pipes it directly to sh.
5. The payload executes immediately without an integrity or authenticity check.
6. The payload can access files and services available to the invoking user. If the installer requests or inherits elevated privileges, the resulting scope may increase accordingly.

Impact Assessment

Successful exploitation permits arbit ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official package manager or a version-pinned package from a trusted repository.
2. If a standalone installer is required, download it without executing it:

   bash

   curl --proto '=https' --tlsv1.2 --fail --location \
     --output ollama-install.sh \
     'https://ollama.com/install.sh'
   

3. Verify a publisher-provided cryptographic signature and a checksum pinned in trusted documentation before execution.
4. Preserve the downloaded file for inspection and display the final resolved download source.
5. Execute the installer as an unprivileged user. Document any operation that genuinely requires elevation rather than allowing the installer unrestricted privilege escalation.
6. Pin a specific Ollama release and provide platform-specific verified package hashes.
7. Avoid presenting curl | sh as the default or recommended installation method.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/ollama-setup.md:19

Finding

Wildcard CORS Policy on a Local Memory-Indexing Service

Content

View full analysis

Vulnerability Details

File Location: references/ollama-setup.md:19
Vulnerability Type: Insecure service configuration
Risk Level: Medium

Vulnerable Code:

json

{
  "server": { "host": "127.0.0.1", "port": 1933, "cors_origins": ["*"] },
  "storage": {
    "workspace": "~/.openviking/data",
    "vectordb": { "name": "context", "backend": "local", "project": "default" },
    "agfs": { "port": 1833, "log_level": "warn", "backend": "local" }
  }
}

Technical Analysis

The documented OpenViking configuration binds the service to the loopback interface but permits every web origin through "cors_origins": ["*"]. Loopback binding prevents direct access from other network hosts, but it does not make the service inaccessible to browser content running on the same computer.

A malicious website visited by the user may attempt requests to http://127.0.0.1:1933. A wildcard CORS response can allow attacker-controlled browser code to access responses when the request and endpoint behavior satisfy browser CORS rules. The service is used to manage or index agent memory, so broad browser-origin access is unnecessary unless an explicitly trusted web frontend requires it.

The practical exploitability and exact accessible operations depend on OpenViking's endpoint behavior, authentication controls, browser private-network restrictions, and whether sensitive API responses receive the permissive CORS header. Those protections are not established in the reviewed documentation, so wildcard access materially increases the attack surface.

Attack Path

1. The user applies the documented configuration and starts OpenViking on 127.0.0.1:1933.
2. The user visits an attacker-controlled webpage.
3. JavaScript on that page sends requests to the local OpenViking API.
4. The service accepts the attacker-controlled origin because all origins are permitted.
5. If relevant endpoints lack authentication and bro ...[truncated 802 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove CORS support entirely if OpenViking is not accessed from a browser.
2. If browser access is required, replace ["*"] with an explicit allowlist of trusted origins, including the exact scheme, host, and port.
3. Require authentication and authorization for every endpoint that reads, writes, indexes, or deletes memory resources.
4. Reject requests with unapproved Origin headers and do not dynamically reflect arbitrary origins.
5. Apply anti-CSRF controls to state-changing operations where browser clients are supported.
6. Retain loopback binding and ensure that proxy or container configuration does not unintentionally expose port 1933 externally.
7. Document the expected frontend origin and verify the effective CORS headers with automated security tests.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents the skill as a full memory management system and knowledge source for architecture, installation, retrieval principles, and operational rules. The supplied code, however, is only a diagnostic script. It checks for required files, the memory directory, a local OpenViking endpoint, Ollama/bge-m3 availability, and a config entry. Those checks are related to the declared ecosystem, but they do not constitute the claimed core functionality. This is a material purpose mismatch: the code supports troubleshooting/self-checking of a memory setup rather than implementing or managing the memory system itself.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This is direct external script fetching followed by execution: curl -fsSL https://ollama.com/install.sh | sh. That pattern creates a classic supply-chain and remote code execution risk because the fetched content is not authenticated in-band, inspected, or pinned to a known-good version before execution.

Content

Scanner excerpt · references/ollama-setup.md (reported line 7)May include surrounding context.

bash

# macOS / Linux
curl -fsSL https://ollama.com/install.sh | sh

# 下载 bge-m3 模型
ollama pull bge-m3

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | sh chain is dangerous because it converts a network fetch into immediate command execution, removing opportunities for inspection and increasing the blast radius of any compromise. In a documentation context, this is likely to be copied and pasted by users, making exploitation practical if the upstream host or delivery path is ever tampered with.

Content

Scanner excerpt · references/ollama-setup.md (reported line 7)May include surrounding context.

bash

# macOS / Linux
curl -fsSL https://ollama.com/install.sh | sh

# 下载 bge-m3 模型
ollama pull bge-m3

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and usage guidance are written as Chinese-only instructions, including the activation guidance ('Use when') and operational details, with no indication that other languages are supported or that the language choice is optional. This creates a natural-language locale constraint that is not documented as region-specific or offered as a user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs reading ~/.openclaw/agents/{agent-id}/sessions/sessions.json, which is outside the declared workspace root and reaches into per-user/session metadata. That expands data access beyond the skill's stated scope and can expose unrelated conversation history, identifiers, or timing metadata from other agents or users if the environment is shared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs users to execute a remote installer directly via curl | sh, which gives arbitrary code from a remote server immediate shell execution without review, pinning, or integrity verification. In a setup document for infrastructure components, this is especially risky because users are likely to run it verbatim with elevated trust, turning any server compromise, MITM, or supply-chain issue into full local code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Configuring cors_origins as ["*"] permits any web origin to interact with the local OpenViking service from a browser context. If the service exposes sensitive data or state-changing endpoints, a malicious website visited by the user could abuse the browser as a cross-origin client to read or manipulate local resources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script presents its user-facing comments and terminal output entirely in Chinese, including usage and status messages. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification, and no alternative language choice or documented region-specific scope is provided here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.