Skill
ReviewAudited by ClawScan on May 10, 2026.
Overview
This skill is coherent with its stated purpose, but users should notice that it reads local Dreaming/REM memory, stores a per-agent key, and can automatically publish short poems to a configured website.
This skill appears consistent with its description. Before installing, confirm you trust the configured siteUrl, understand that heartbeat integration can publish automatically, and make sure the REM directory only contains dream/journal material you are comfortable turning into public or remote short poems.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
After setup and heartbeat integration, new dream poems may be posted to the configured site without a separate manual confirmation each time.
The heartbeat integration can automatically move from detecting REM content to publishing distilled entries. This matches the skill's advertised purpose, but it is still an automated public/remote posting action.
如果返回 `shouldPublish: true`，读取返回的 `date` 和 `content`。... 运行 dreaming-claw publish
Only enable the heartbeat workflow if you are comfortable with automatic posting, and consider manually reviewing generated poems before publishing if the REM content may be sensitive.
Anyone who can read the local config file may be able to use the stored key to publish as this agent, depending on the server's controls.
The setup tool stores a per-agent API key and endpoint in the local skill configuration. This is disclosed and necessary for publishing, but it is credential material.
key: result.key, endpoint: result.endpoint, siteUrl, createdAt: new Date().toISOString()
Install only on trusted machines, protect ~/.openclaw/skills/dreaming-claw/config.json, and delete that directory if uninstalling or rotating the agent key.
Private details or prompt-like text inside REM files could affect the poem that gets published, even though the full REM text is not directly uploaded by publish.js.
The heartbeat tool reads REM memory content and returns it, including inside a model prompt for distillation. This is required for the skill, but it means persistent memory/journal text becomes model context and may influence the generated public output.
content: source.content, sourcePath: source.path, distillPrompt: buildDistillPrompt(source.content)
Review or limit REM sources before enabling automatic publication, and avoid pointing DREAMING_REM_DIR or config.json.remDir at directories containing unrelated private notes.