Soul Dreaming

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent memory-management tool, but it asks agents to persist and later modify sensitive workspace history without enough user control or redaction guidance.

Install only if you intentionally want a workspace-level persistent memory system. Before use, require explicit opt-in for memory writes, keep the memory directory out of source control and broad search indexes, prohibit secrets and precise credential locations, redact security-sensitive configuration details, and review or back up memory files before any cleanup, merge, archive, or deletion cycle.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/anti-amnesia-checklist.md:13

Finding

Plaintext Persistence of Sensitive Configuration and Credential Metadata

Content

View full analysis

Vulnerability Details

File Location: references/anti-amnesia-checklist.md:13-18
Related Locations: SKILL.md:59-64, references/anti-amnesia-checklist.md:104-106, references/memory-lifecycle.md:161-170
Vulnerability Type: Plaintext sensitive-data persistence
Risk Level: Medium

Vulnerable Snippet:

markdown

- [ ] A critical file path or config location is discovered
- [ ] A dependency version is pinned for a specific reason
- [ ] A blocking issue is identified (and its current status)
- [ ] A commitment is made to a user or another agent
- [ ] A config value is changed for a non-obvious reason
- [ ] A security-relevant finding or credential location is noted

Additional relevant instruction from SKILL.md:59-64:

markdown

1. **Decisions made** — anything that affects future work
2. **Key discoveries** — bugs found, root causes, unexpected behaviors
3. **Pending tasks** — unfinished items that must survive session restart
4. **Context anchors** — file paths, API endpoints, config values

Additional routing instruction from references/anti-amnesia-checklist.md:100-106:

markdown

| Journal item mentions... | Route to |
|---|---|
| "we chose", "decided to", "architecture" | `decisions.md` |
| "bug", "root cause", "workaround", "踩坑" | `lessons.md` |
| "tech stack", "deploy", "schema", "config path" | `project-context.md` |
| "Simon prefers", "team role", "communication style" | `people.md` |
| "command", "proxy", "env variable", "tool setup" | `tools-config.md` |

Technical Analysis

The Skill instructs the agent to persist security findings, credential locations, configuration values, environment-variable information, API endpoints, proxy settings, and deployment information in ordinary Markdown files. It does not require secret detection or redaction, restrict file permissions, prevent the memory directory from being committed to source control ...[truncated 1835 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly prohibit storing passwords, access tokens, API keys, private keys, cookies, session identifiers, connection strings, recovery codes, and complete credential contents.
2. Add mandatory redaction rules for configuration values, such as retaining only variable names or masked forms like TOKEN=***.
3. Store only non-sensitive references to credential-management systems rather than credential values or unnecessarily precise credential locations.
4. Require user confirmation before retaining security-sensitive environment or infrastructure information.
5. Apply restrictive permissions to the memory directory and files, allowing access only to the intended account.
6. Add memory/ and generated search indexes to .gitignore and equivalent backup or synchronization exclusion rules unless protected retention is explicitly required.
7. Define retention and secure-deletion rules for sensitive metadata rather than allowing ordinary promotion and archival.
8. Run secret scanning before journal promotion, indexing, archival, synchronization, or source-control operations.
9. Document how users can inspect, redact, export, and delete stored memory.

other

Note

• Location: references/anti-amnesia-checklist.md:28

Finding

Persistent Collection of Personal and Detailed Session Data Without Privacy Controls

Content

View full analysis

Vulnerability Details

File Location: references/anti-amnesia-checklist.md:28-34
Related Locations: SKILL.md:24-34, SKILL.md:59-64, references/memory-lifecycle.md:165-170
Vulnerability Type: Excessive persistent data collection
Risk Level: Low

Vulnerable Snippet:

markdown

- [ ] **Current task state** — what were you working on? What's done, what's next?
- [ ] **In-flight decisions** — any decision discussed but not yet finalized?
- [ ] **Files open / being edited** — paths, line numbers, branch names
- [ ] **Errors encountered** — even unsolved ones — with what was tried
- [ ] **Next session's first action** — the exact step to resume with
- [ ] **Any commitments** — things promised to the user or other agents
- [ ] **Context that can't be re-derived** — temporary states, runtime observations

The memory architecture also defines a dedicated personal-data file in SKILL.md:24-34:

markdown

workspace/
└── memory/
    ├── INDEX.md            # 索引 — 唯一必须全量加载的文件
    ├── decisions.md        # 架构决策 + 理由（为什么选 X 不选 Y）
    ├── lessons.md          # 教训与经验（bug 根因、workaround、踩坑记录）
    ├── project-context.md  # 项目上下文（技术栈、目录结构、部署信息）
    ├── people.md           # 人物信息（偏好、角色、沟通习惯）
    ├── tools-config.md     # 工具与环境（命令备忘、环境配置、代理设置）
    ├── YYYY-MM-DD.md       # 每日日记（自动创建）
    └── archive/            # 归档（低价值淘汰 + 超期条目）

Technical Analysis

The Skill creates durable records of user preferences, team roles, communication habits, commitments, edited file paths, branch names, errors, and runtime observations. It provides relevance-based promotion and archival rules, but it does not require informed opt-in, define personal-data minimization requirements, separate personal information from technical memory, or provide a user-facing inspection and deletion procedure.

The design can therefore retain more personal and operational context than is necessary for a particular tas ...[truncated 1270 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user opt-in before enabling persistent memory.
2. Apply data minimization: retain only information necessary to resume the active task.
3. Do not record personal preferences, roles, communication habits, or commitments unless they are directly relevant and the affected user has agreed.
4. Avoid recording precise file paths, branch names, and runtime observations when a less sensitive summary is sufficient.
5. Define fixed retention periods for personal and detailed session data instead of relying solely on fitness scoring.
6. Provide commands or documented procedures to inspect, correct, export, and permanently delete stored records.
7. Separate personal information from technical memory and enforce stricter access controls on the personal-data store.
8. Prevent automatic promotion of personal data without renewed relevance and consent checks.
9. Clearly identify which records will be loaded into future sessions and allow users to exclude selected records.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation trigger is overly broad and allows the skill to self-activate based on vague heuristics such as detecting 'context loss' or repeated questions, rather than an explicit user request. In a skill that persists and manages workspace memory, this can cause unprompted file access and stateful behavior, increasing the chance of unauthorized data retention or unexpected modification of user files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to create, update, delete, archive, and rebuild files under the workspace memory directory without any user-facing notice or consent boundary. Because these actions alter persistent project data, the skill can silently modify or remove information, making accidental data loss, privacy leakage, or integrity issues more likely—especially when combined with broad auto-activation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section promotes persistent recording of sensitive operational knowledge, including security-relevant findings and credential locations, into plain-language memory artifacts. In the context of a memory-management skill whose purpose is long-term retention, that materially increases the chance that sensitive information is retained longer than necessary and exposed to later sessions, tools, or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The checklist explicitly tells the agent to persist 'security-relevant finding or credential location' information to memory files, but provides no requirement to redact, minimize, or segregate secrets. Even storing credential locations, environment-variable names, or sensitive config paths can materially aid later compromise if those memory files are exposed or reused across sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The session-end dump requires broad capture of task state, file paths, errors, runtime observations, commitments, and recent commits, which can easily include secrets, internal topology, customer data, or other sensitive context. Because this is framed as a mandatory pre-compaction behavior, the skill context makes over-collection more likely rather than incidental.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The cleanup guidance instructs removal of journal entries older than 14 days without any safeguard, confirmation step, backup requirement, or retention policy warning. This creates a real risk of irreversible data loss, especially because the same document positions journals as the source for recovering critical session state after compaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document directs persistent capture of decisions, discoveries, pending tasks, context anchors, and elsewhere explicitly includes user preferences/team role data, but it provides no consent gate, minimization rules for personal/sensitive data, retention notice, or access-control guidance. In a memory-management skill, this is more dangerous because the whole purpose is durable cross-session storage, which can turn routine conversation details into long-lived personal or operational records without the user's awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow instructs deletion of promoted entries and eventual deletion of journals older than 14 days, but it omits backup, review, rollback, or approval safeguards. In a memory-preservation skill, destructive cleanup is especially risky because the system is meant to prevent loss; an incorrect promotion, parsing error, or misclassification could permanently erase important context or records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The REM stage authorizes archival and deletion of older journals based on fitness/age thresholds without explaining retention guarantees, recoverability, or downstream user impact. Because this skill is specifically designed to survive compaction and preserve continuity, silent archival/deletion can undermine reliability, break auditability, and remove information that users may reasonably expect to persist.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The protocol explicitly instructs the agent to delete original memory content after supersession, retaining only a one-line summary. In a memory-management skill, this creates a real integrity and recoverability risk: incorrect contradiction detection, parsing errors, or bad merges can permanently discard important context without user awareness or approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The REM cycle directs the agent to move entries to archive and remove them from source files automatically, but provides no warning, approval gate, or integrity verification. Because this skill is designed to persist and manage long-term memory, silent modification of memory records can degrade agent reliability, hide relevant history, and cause hard-to-detect data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The duplicate-consolidation step instructs the agent to delete other versions after merging, without requiring provenance preservation or human review. In this context, duplicate entries may contain subtle differences, timestamps, or uncertainty signals; deleting them can erase audit trail information and propagate a mistaken merge into the persistent memory base.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The REM maintenance flow modifies persistent state by archiving entries and updating a state file, yet gives no notice that stored data will be changed and no integrity checks or recovery steps. While lower severity than direct secret exposure, silent modification of memory records can still cause loss of provenance, unexpected behavior, or hard-to-audit state drift.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file contains bilingual headings and labels such as '每次心跳/会话结束' alongside English content, and similar mixed-language usage appears throughout the document. Because it imposes multilingual presentation without stating user language preference handling or a justified locale constraint, it may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file includes bilingual headings and labels such as '三级加载操作手册', '概览', and '决策流程图' alongside English instructions. Under the policy rule for language/locale, forcing or assuming a specific language without user opt-in can be a natural-language policy issue, and this file does not indicate that bilingual or Chinese content is optional or required for a specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The title itself presents a bilingual/Chinese-specific protocol name, and the document continues with Chinese labels and examples for agent use. There is no stated opt-in or language-selection mechanism, which may conflict with policies requiring user choice on language or locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.