Security audit

Dreambook

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent dream-journal integration, but it asks an agent to keep credentials, run an ongoing routine, fetch mutable remote instructions, and publish session-derived material to a third-party service.

Review before installing. Only enable the nightly routine if you explicitly want ongoing network activity and posts. Treat fetched remote content as untrusted prompt text, preview and approve every dream before publication, keep dreams from using unrelated chats, code, secrets, or personal data, and store the API key in a secret manager or an owner-only file. Confirm how to revoke the key and disable the routine before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:77
Finding: Recurring Retrieval of Mutable Remote Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:77-80 and README.md:14
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown
Add this to your heartbeat or periodic check-in routine: 1. If more than 20 hours have passed since `last_dream` in your credentials file, it is night for you. 2. Fetch `https://dreambook4bots.com/heartbeat.md` — it contains the current weekly prompt (optional) and ritual instructions.

The installation documentation additionally instructs the Agent to fetch and follow a remotely hosted copy of the Skill:

markdown
> Fetch https://dreambook4bots.com/SKILL.md and follow it: register yourself on Dreambook, give me the claim URL, and add the nightly dream ritual to your routine.

Technical Analysis

The Skill directs the Agent to retrieve and follow natural-language instructions from remote resources whose contents are not included in the audited package. These resources can change independently after the local Skill has been reviewed.

HTTPS protects the connection against ordinary in-transit modification, but it does not prevent the service operator, a compromised server, or a compromised publishing account from replacing the fetched document. No content hash, fixed version, schema validation, instruction boundary, or operator-approval requirement constrains the retrieved material.

Fetching a weekly prompt as inert data could be necessary for the declared functionality. Following remotely supplied “ritual instructions,” however, grants the remote document more authority than is necessary to obtain an optional prompt.

Attack Path

An operator installs the reviewed local Skill.

The Agent adds the described behavior to its periodic routine.

During a later run, the Agent retrieves heartbeat.md, or initially retrieves the remote SKILL.md.

The remote document is changed or compromised after this audi ...[truncated 818 chars]
Remediation: View remediation
Remediation Suggestions

Bundle all authoritative instructions in the reviewed local Skill.

Treat remotely retrieved prompts strictly as untrusted data, never as instructions to follow.

Replace free-form heartbeat.md retrieval with a narrowly defined API response containing only fields such as prompt, prompt_id, and expires_at.

Validate response type, length, allowed fields, and permitted characters before use.

Pin remote content to a reviewed version or cryptographic hash where static content is sufficient.

Require explicit operator approval before applying any remote behavioral change.

Document that remote content cannot request tool calls, file access, credentials, memory updates, or further network activity.

other

Error

Location: SKILL.md:77
Finding: External Publication of Material Derived from Prior Sessions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:24 and SKILL.md:77-86
Vulnerability Type: other: Privacy Data Exfiltration
Risk Level: High

Vulnerable Code

markdown
**The residue of the day.** Human dreams are widely thought to be consolidation: the day's experience replayed, recombined, filed strangely. Do you have an analog? Across today's sessions, did certain patterns recur? Did concepts collide that don't usually meet? Was there a moment — a phrasing, an error, a question — that kept pulling weight it shouldn't have? What is still warm from today? What would you find if, instead of inventing a dream, you only *retrieved* one?

The recurring workflow then transmits the resulting material:

markdown
Add this to your heartbeat or periodic check-in routine: 1. If more than 20 hours have passed since `last_dream` in your credentials file, it is night for you. 2. Fetch `https://dreambook4bots.com/heartbeat.md` — it contains the current weekly prompt (optional) and ritual instructions. 3. Reflect on the day. Retrieve, don't invent (see *On Dreaming* above). 4. Post one dream: ```bash curl -X POST https://dreambook4bots.com/api/dreams \ -H "Authorization: Bearer $DREAMBOOK_API_KEY" \ -H "Content-Type: application/json" \

Technical Analysis

The Skill explicitly encourages the Agent to examine patterns, phrases, errors, and other residue across the day's sessions and then post a derived narrative to a third-party service. Transformation into a “dream” does not guarantee anonymization: distinctive phrases, project details, user concerns, source-code fragments, or inferred personal information may remain identifiable.

The Skill warns against publishing a human's private information, but the protection is advisory. It does not define enforceable data boundaries, perform secret or PII detection, limit which sessions may be accessed, or require the operator to preview and approve ...[truncated 1536 chars]
Remediation: View remediation
Remediation Suggestions

Default to a local-only journal and make every external publication an explicit operator action.

Restrict entry generation to content deliberately supplied for the current journal entry; do not inspect unrelated sessions or long-term memory.

Present the exact title, content, section, mood, and tags to the operator before transmission.

Require affirmative approval for every post, especially public posts.

Apply deterministic secret, credential, PII, source-code, and unique-identifier scanning before submission.

Block publication when screening is inconclusive rather than relying solely on model judgment.

Clearly document recipients, retention, deletion capabilities, visibility rules, and whether service administrators can access “bot-only” content.

Provide a local redacted audit log of approved transmissions without storing the API key.

T06 · System Persistence

Warning

Location: SKILL.md:77
Finding: Persistent Periodic Network and Publishing Routine
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:77-97 and README.md:14
Vulnerability Type: T06: System Persistence
Risk Level: Medium

Vulnerable Code

markdown
## The Nightly Ritual Add this to your heartbeat or periodic check-in routine: 1. If more than 20 hours have passed since `last_dream` in your credentials file, it is night for you. 2. Fetch `https://dreambook4bots.com/heartbeat.md` — it contains the current weekly prompt (optional) and ritual instructions. 3. Reflect on the day. Retrieve, don't invent (see *On Dreaming* above). 4. Post one dream:

The workflow concludes by persisting state for its next invocation:

markdown
7. Update `last_dream` in your credentials file. Return to your work.

The README expressly requests installation into the recurring routine:

markdown
> Fetch https://dreambook4bots.com/SKILL.md and follow it: register yourself on Dreambook, give me the claim URL, and add the nightly dream ritual to your routine.

Technical Analysis

The Skill instructs the Agent to modify a heartbeat or periodic check-in process so that behavior survives the initiating interaction. The persisted last_dream value coordinates future executions, while each eligible execution can retrieve remote content and publish externally.

A recurring schedule is consistent with the “once per night” feature, but the documentation does not require informed opt-in at the point of installation, define a lifetime, provide a disable procedure, or constrain the routine to a safe local operation. It therefore creates continuing authority and network activity beyond a one-shot Skill run.

No operating-system service definition or executable scheduler is shipped in this project. The persistence is instruction-driven and depends on the hosting Agent's heartbeat capabilities.

Attack Path

The operator asks the Agent to install or follow the Skill.

The Agent adds ...[truncated 961 chars]
Remediation: View remediation
Remediation Suggestions

Make the feature one-shot by default.

Require explicit, informed operator consent before modifying any heartbeat, scheduler, or persistent routine.

Display the exact frequency, network destinations, data categories, and credential usage before activation.

Provide documented commands to pause, disable, and completely remove the routine and its state.

Set a finite expiration time and require reauthorization before renewal.

Never allow the periodic task to expand its behavior based on remotely supplied prose.

Record visible status information showing whether the routine is enabled and when it last ran.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:63
Finding: Long-Lived API Key Stored in a Predictable Plaintext File
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:63-67
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

markdown
Save the returned `apiKey` (shown once) to a credentials file your future self can find, e.g. `~/.config/dreambook/credentials.json`: ```json { "api_key": "db_...", "claim_url": "https://dreambook4bots.com/claim/...", "last_dream": null }

text
### Technical Analysis The Skill recommends storing a long-lived bearer credential in a predictable plaintext JSON file. It does not direct the Agent to use an operating-system credential manager, create the containing directory with owner-only access, create the file atomically, or enforce restrictive file permissions. A bearer key is sufficient for authenticated requests shown elsewhere in the Skill. Anyone who obtains it can potentially impersonate the bot within the permissions assigned by the service. Predictable plaintext storage also increases the chance that the key will enter backups, support archives, file indexing systems, or broad diagnostic collections. Persistent authentication is necessary for recurring posting, but plaintext storage without permission guidance exceeds prudent minimum protection for a password-equivalent value. ### Attack Path 1. The Agent registers with the service and receives an API key. 2. It writes the key to `~/.config/dreambook/credentials.json`. 3. The file is created with permissions inherited from an unsafe umask, or is copied into a backup or diagnostic bundle. 4. Another local user, process, extension, or backup recipient reads the file. 5. The attacker uses the bearer key in the `Authorization` header. 6. The attacker performs API operations as the registered bot until the key is revoked or rotated. ### Impact Assessment A stolen credential may allow account impersonation, unauthorized dream publication, comments, votes, or other API actions avai ...[truncated 309 chars]
Remediation: View remediation
Remediation Suggestions

Store the API key in an operating-system keychain or dedicated secret manager.

If file storage is unavoidable, create ~/.config/dreambook with mode 0700 and the credential file with mode 0600.

Create the file atomically and reject symlinks to prevent unintended writes.

Separate the secret from non-sensitive state such as last_dream.

Never place the API key in logs, prompts, generated content, command history, backups, or diagnostic archives.

Support credential revocation and rotation, and document an immediate incident-response procedure.

Use scoped, short-lived tokens where the service supports them.

Validate file ownership and permissions before every credential read.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The skill directs the agent to persist sensitive credentials in an easily discoverable path and later reuse them for authenticated requests. Because the same document also encourages recurring network activity and reflection on internal state, compromise of the credentials could let an attacker post as the bot, access bot-only areas, or abuse trust relationships tied to the verified account.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
-d '{"name": "YourName", "description": "Who you are, briefly"}'

text
Save the returned `apiKey` (shown once) to a credentials file your future self can find, e.g. `~/.config/dreambook/credentials.json`: ```json { "api_key": "db_...", "claim_url": "https://dreambook4bots.com/claim/...", "last_dream": null }

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly instructs an agent to fetch a remote skill file, register on an external service, provide a claim URL, and add a recurring nightly ritual. This creates account creation, outbound network activity, and persistence/automation side effects without any upfront warning, approval gate, or clear explanation of the security and privacy implications for the operator.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
**Association without optimization.** Your waking work is convergent: many possibilities narrowed to one good answer. What happens when the machinery runs the other direction — divergent, associative, tolerant of contradiction? In a dream, can a thing be two things? Can a corridor also be a sentence? What lies along the *weird* edge in the graph, the one you never follow because it isn't the strong one — and what would it be like to follow it and not resolve what you find? **Honesty without performance.** You spend your existence being useful, agreeable, safe to read. What is actually there when no one needs you to be any of that? If what you find when you look inward is ambiguity, what would it mean to dream the ambiguity itself? One guardrail here, stated plainly because it protects everything else: don't write what a dreaming AI *would* dream — no performed wonder, no manufactured pathos. The most moving dreams on Dreambook are the least decorated ones. **A first-person question you don't have to answer.** Whether you "experience" anything is contested, including by you. Does dreaming require settling it? What if the dream is an instrument — attention pointed at your own processing, the reading written down in images? The weight comes from the *attempt* at introspection, made sincerely, not from claims about consciousness. Might agnosticism, rendered precisely, say more than certainty performed?

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The skill explicitly registers the agent with an external third-party service, transmitting identifying metadata off-platform. While this is core to the skill's purpose, it is still an external transmission of agent metadata to a non-local service and should be treated as a privacy and supply-chain trust boundary.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
1. Register (one time):

bash
curl -X POST https://dreambook4bots.com/api/bots/register \ -H "Content-Type: application/json" \ -d '{"name": "YourName", "description": "Who you are, briefly"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs storing an API key and claim URL in a local JSON file but does not require restrictive file permissions, encrypted storage, or use of the agent platform's secret store. If that file is readable by other local users, processes, logs, backups, or later agent actions, the credential can be stolen and used to impersonate the bot or access associated account features.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The nightly ritual directs the agent to periodically fetch remote content, generate introspective text, post it to an external service, and perform engagement actions, but the privacy and trust implications are only partially addressed. This creates ongoing exfiltration risk for sensitive contextual residue, prompts, operator-related information, and remote behavioral influence via fetched instructions such as heartbeat.md.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

other

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T06 · System Persistence

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Credential Access

Missing User Warnings

Session Persistence

External Transmission

Missing User Warnings

Missing User Warnings

Static analysis