Dream

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:15 AM UTC
• Version: 0.2.1

Overview

This memory-management skill matches its stated purpose, but it needs Review because it permanently retains personal memory and ships a helper script with unsafe file-write and code-injection behavior.

Install only if you are comfortable with automatic local memory rewriting, permanent archives, and personal context resurfacing later. Before use, restrict atomic writes to approved paths, fix the Python timestamp handling, require confirmation for forget/delete actions, and add a real full-erasure path for ledger and re-emergence records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: dream-tools.sh:92

Finding

Unrestricted Atomic-Write Command Allows Arbitrary File Replacement

Content

View full analysis

" [[ ! -f "$tmpfile" ]] && die "tmp 文件不存在：$tmpfile" # 若目标是 MEMORY.md，检查字符数上限 if [[ "$(realpath "$target" 2>/dev/null)" == "$(realpath "$MEMORY_MD" 2>/dev/null)" ]] || \ [[ "$target" == *"MEMORY.md" ]]; then local size size=$(wc -c < "$tmpfile" | tr -d ' ') if [[ $size -gt $MEMORY_HARD_LIMIT ]]; then die "写入中止：tmp 文件大小 ${size} 字符，超过硬上限 ${MEMORY_HARD_LIMIT}。请先压缩内容。" fi log "MEMORY.md 写入校验通过：${size}/${MEMORY_HARD_LIMIT} 字符" fi ensure_dir "$target" # mv 在同一文件系统上是原子操作 mv "$tmpfile" "$target" log "原子写入完成：$target" } ``` ### Technical Analysis The `--atomic-write` operation accepts both its source and destination from command-line arguments. It does not verify that the canonical destination is located under either `DREAM_VAULT_PATH` or `OPENCLAW_WORKSPACE`. The `realpath` comparison only determines whether to apply the `MEMORY.md` size limit. It is not an access-control check. For any destination that does not end in `MEMORY.md`, the script creates the destination's parent directory and moves the supplied file over the destination. Consequently, any component or user able to invoke this helper can replace any file writable by the OpenClaw operating-system account. This directly contradicts the security claim in `readme.md` that all file operations are strictly scoped to the vault and workspace. Path and symlink behavior also require hardening. A lexical prefix check alone would not be sufficient because traversal components and symlinks could redirect writes outside an approved root. ### Attack Path 1. Th ...[truncated 1429 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: dream-tools.sh:455

Finding

Persisted Timestamp Is Interpolated into Executable Python Source

Content

View full analysis

/dev/null; then hours_since=$(python3 -c " from datetime import datetime last = datetime.strptime('$last_review', '%Y-%m-%d %H:%M') diff = datetime.now() - last print(int(diff.total_seconds() / 3600)) " 2>/dev/null || echo "-") fi fi ``` ### Technical Analysis The contents of `meta/last-review.txt` are read into `last_review` and inserted directly inside a single-quoted Python string embedded in the `python3 -c` program. Shell quoting does not make this safe: variable expansion occurs inside the outer shell double-quoted argument, and the expanded data becomes part of the Python source. A crafted timestamp can close the Python call, inject another Python statement, and comment out the remaining generated source. This is source-code injection rather than ordinary malformed-input handling. No strict format validation occurs before interpolation. For example, a value shaped like the following can preserve a valid initial timestamp parse and then inject another statement: ```text 2026-01-01 00:00', '%Y-%m-%d %H:%M'); __import__('os').system('id'); # ``` The generated Python source executes the injected `os.system` call when `--status` is invoked. ### Attack Path 1. The attacker modifies: ```text DREAM_VAULT_PATH/meta/last-review.txt ``` This may occur through local write access, a compromised cooperating component, or the unrestricted `--atomic-write` operation identified separately. 2. The attacker stores a Python-breaking payload in the file: ```text 2026-01-01 00:00', '%Y-%m-%d %H:%M'); __import__('os').system('id'); # ``` 3. A user or scheduled agent invokes: ```bash ./dream-too ...[truncated 864 chars]

Remediation

View remediation

other

Warning

• Location: Skill.md:264

Finding

Forget Operation Retains Requested Data in a Permanent Searchable Archive

Content

View full analysis

` — 从 memory 中清除 在 `memory/YYYY-MM-DD.md` 和 MEMORY.md 中语义搜索匹配条目并清除。 无需确认，直接执行。 **Re-emergence 机制：** 清除时将条目摘要写入 `meta/removed-entries.json`，记录清除时间和内容哈希。 后续对话中若该内容再次出现，自动触发 re-emergence，重新写入 MEMORY.md 并提升优先级。 被遗忘后又出现的内容，比从未被遗忘的内容更值得保留。 ledger 中的记录不受 `dream forget` 影响，永久保留。 执行时告知：「已从记忆中清除，永久档案不受影响。」 ``` In English, these instructions state that `dream forget` removes matching entries from daily memory files and `MEMORY.md`, but records a summary in `removed-entries.json` and leaves ledger records permanently intact. ### Technical Analysis The operation is named and presented as a memory-forgetting function, but its erasure scope excludes the permanent ledger. It also deliberately writes a summary and content hash to re-emergence tracking state. The retention behavior is disclosed in the skill instructions, so it is not a covert exfiltration mechanism. Nevertheless, it creates a privacy and lifecycle-control weakness: sensitive information can remain searchable after the active-memory copies have been removed. The design provides no documented command for deleting or redacting the retained ledger record. Because the ledger is described as append-only and never deleted, a user cannot achieve complete erasure through the provided interface. ### Attack Path 1. Sensitive personal information is captured and eventually archived in `ledger.md` and `ledger-index.json`. 2. The user invokes `dream forget` for that information. 3. Dream removes matching data from active memory files. 4. The ledger copy remains unchanged, while a summary and hash may also be added to `meta/removed-entries.json`. 5. A later `--ledger-search` or direct file read retrieves the supposedly forgotten information. ### Impact Assessment This issue does not provid ...[truncated 515 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file allocation section labels daily memory files as read-only for Dream, yet later workflows direct the skill to write to and delete from those same files. This inconsistency is dangerous because it broadens write/destructive scope beyond what reviewers expect, increasing the risk of unauthorized modification or loss of memory data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The dream forget workflow performs semantic search and deletion across memory stores without confirmation. Because the match is fuzzy and the action is immediate, the skill can delete the wrong entries or be triggered by ambiguous requests, causing irreversible loss or corruption of user memory state.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The forget workflow tells the user content has been cleared from memory while explicitly preserving permanent copies in the ledger. This is dangerous because it creates a false expectation of deletion, undermines user trust, and can retain sensitive data indefinitely despite a deletion request.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · readme.md (reported line 12)May include surrounding context.

md

OpenClaw's native memory mechanism has three unhandled issues:

**1. MEMORY.md grows indefinitely and silently truncates**
OpenClaw truncates MEMORY.md at 20,000 characters — no error, no warning. The AI quietly loses the second half of your context. You think it remembers, but it doesn't. Dream triggers compression at 18,000 characters, archiving stale content to the ledger so MEMORY.md always stays within the effective range.

**2. No permanent archive**
Important memories disappear once cleaned up. Dream maintains a `ledger.md` — append-only, never deleted. Anything that has ever reached long-term memory is preserved forever, even after being forgotten, and remains searchable for deep recall.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims Dream is only a distiller and not a capture mechanism, but later instructs the agent to write newly observed conversational information directly into MEMORY.md during live conversations. This mismatch can mislead operators and users about when persistence occurs, weakening informed consent and making unintended data retention more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to write conversation-derived data into MEMORY.md in real time without telling the user at the moment of persistence. Silent background writes of profile, preference, and project data undermine user awareness and can store sensitive information the user did not expect to be retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The scheduled dream review process is designed to run silently and modify persistent memory artifacts without notifying the user. Background mutation of long-lived memory increases privacy and integrity risk because sensitive content may be transformed, archived, or surfaced later without contemporaneous user awareness.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill explicitly stores and later surfaces personal data such as preferences, projects, and important relationships in MEMORY.md, ledger files, and wakeup summaries. Even if intended for continuity, persistent aggregation and resurfacing of personal context increases privacy exposure if the files are accessed by other tools, users, or future sessions unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The header comments and all user-facing help/output strings are written only in Chinese, which effectively imposes a language choice on users without offering an alternative or opt-in. The policy specifically calls for flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script invokes the external openclaw CLI via a shell command to query agent status. Although the code comments describe the behavior, there is no user-facing disclosure, confirmation, or prompt around this subprocess execution, and shell execution is one of the operations that requires some visible warning unless clearly disclosed as part of the skill behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The script implements persistent recording of conversation-derived or agent-derived data into multiple long-lived files such as MEMORY.md, ledger.md, ledger-index.json, removed-entries.json, and active-days.json. This creates session persistence that can retain sensitive user content, behavioral history, and metadata without any built-in consent, retention control, access restriction, or data minimization, which is a real privacy/security risk if secrets or personal data are captured.

Content

Scanner excerpt · dream-tools.sh (reported line 502)May include surrounding context.

sh

--check-idle)             cmd_check_idle ;;
    --check-size)             cmd_check_size ;;
    --hash)                   cmd_hash "$@" ;;
    --atomic-write)           cmd_atomic_write "$@" ;;
    --ledger-append)          cmd_ledger_append "$@" ;;
    --ledger-search)          cmd_ledger_search "$@" ;;
    --ledger-mark-reemergence) cmd_ledger_mark_reemergence "$@" ;;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises that it runs silently every night and modifies memory-related files automatically, but the README does not emphasize ongoing background data mutation, retention consequences, or operator visibility. This creates a consent and integrity risk: users may not realize their active memory is being rewritten, compressed, archived permanently, and potentially reintroduced later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented manual triggers are broad natural-language phrases such as "review" and "what do you remember about me," which can plausibly occur in ordinary conversation and unintentionally invoke file-reading or state-changing behavior. In a memory-management skill, accidental activation is risky because it may expose private memory contents, mutate MEMORY.md, or trigger archive/search operations without clear user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.