Dreaming Extractor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This skill collects broad agent conversation history and turns it into persistent memory without enough scoping, privacy controls, or approval.

Install only if you intentionally want a daily memory builder that reads historical agent conversations. Before enabling cron, restrict it to specific agents or directories, review/redact the extraction-input files, require approval before appending to learned.md, and treat the cost cap as advisory until the budget script is hardened.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/collect.py:81

Finding

Unrestricted Collection of Conversation Histories Across All Agents

Content

View full analysis

MAX_CHARS_PER_SESSION: text_parts.append(f"[... truncated at {MAX_CHARS_PER_SESSION} chars ...]") break text_parts.append(chunk) char_count += len(chunk) sessions.append({ "session_id": jsonl_file.stem, "agent": agent_dir.name, "messages": text_parts, "message_count": len(messages), "char_count": char_count, }) ``` ### Technical Analysis The collector defaults to the top-level `~/.openclaw/agents` directory and enumerates every child agent directory. It does not limit collection to the invoking agent, require an explicit agent allowlist, or verify that the caller is authorized to process each agent's history. The extracted user and assistant messages are copied verbatim into a consolidated plaintext extraction file. The implemented noise filter only recognizes a small set of fixed phrases; it does not redact credentials, personal information, access tokens, confidential business data, or other sensitive content. This violates least privilege beca ...[truncated 1262 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:31

Finding

Untrusted Session Content Can Poison Persistent Agent Memory

Content

View full analysis

MAX_CHARS_PER_SESSION: text_parts.append(f"[... truncated at {MAX_CHARS_PER_SESSION} chars ...]") break text_parts.append(chunk) char_count += len(chunk) ``` ```python for msg in sess["messages"]: if total_chars + len(msg) > MAX_TOTAL_CHARS: lines.append(f"[... total output truncated at {MAX_TOTAL_CHARS} chars ...]") return "\n".join(lines) lines.append(msg) total_chars += len(msg) ``` ### Technical Analysis Session messages are untrusted input, but the collector places them verbatim into a document that an LLM is instructed to read and interpret. The Skill then directs the agent to append the resulting facts to persistent `memory/learned.md`. There is no strong separation between extraction instructions and quoted conversation data. There is also no provenance trust policy, schema-enforced output validator, independent verification, or mandatory approval step before persistence. An attacker can therefore place instruction-like text or deliberately false clai ...[truncated 1815 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/budget.py:59

Finding

Daily Cost Cap Can Be Exceeded or Manipulated

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill extracts daily facts from session history into a persistent learned.md file. The supplied code does not extract facts, parse session history, or update learned.md at all. Its sole purpose is cost/budget management for extraction workflows: estimating token-based costs, checking a daily cap, logging runs, showing status, and resetting the day’s budget in extraction-budget.json. This is a materially different primary purpose and involves different file resources and operational interfaces than declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code's primary purpose is a session collection/preprocessing step, not final daily fact extraction into persistent memory. It scans agent session directories, filters sessions by date and noise patterns, formats conversation text, and writes an intermediate .txt file for downstream extraction. There is no logic to identify facts, summarize them into learned memory, or update a learned.md file. While it does operate on AI agent session history and appears related to a memory pipeline, the declared description overstates and mischaracterizes the actual behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs reading agent session history and writing persistent memory files, but it declares no explicit tool scope or permissions. That creates an authorization ambiguity where a runner may grant broader file and environment access than users expect, increasing the chance of unintended data exposure or modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill collects real agent conversations and persists extracted facts, but it provides no privacy warning or consent guidance. Because session histories can contain sensitive user data, credentials, internal URLs, or personal information, silent retention materially raises privacy and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Persisting facts derived from real user conversations into a long-term natural-language memory file creates a durable data retention and exfiltration path. Sensitive information may be transformed into concise 'facts' that are easier to surface later, bypassing expectations that session data is ephemeral or harder to rediscover.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

Cron Setup

bash

openclaw cron add "Dreaming Extractor" "3 3 * * *" "Run task spec: skills/skill-dreaming-extractor/SKILL.md"

Fires daily at 03:03 UTC (after sessions have closed for the day).

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/budget.py (reported line 114)May include surrounding context.

python

print(f"Today total: ${spent:.4f} / ${DAILY_CAP:.2f}")

    # Prune entries older than 60 days
    cutoff = (datetime.now(timezone.utc) - __import__("datetime").timedelta(days=60)).strftime("%Y-%m-%d")
    data["days"] = {k: v for k, v in data["days"].items() if k >= cutoff}
    save_budget(data)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The collector intentionally preserves raw user and assistant text across sessions for downstream processing, creating a concentrated natural-language data lake. In the context of a memory-extraction skill, this is more dangerous because sensitive content from many conversations is centralized into a single artifact that can be read by later tools, models, or users beyond the original session scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script aggregates full session transcripts and writes them to persistent storage without any confirmation, warning, or data-sensitivity guardrail. Because agent session history can contain secrets, personal data, internal prompts, or credentials, silently materializing that content into a reusable file increases the chance of unintended retention, broader access, and later exfiltration.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from os.environ.get (line 213, credential/environment) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/collect.py (reported line 215)May include surrounding context.

python

else:
        output_path = output_dir / f"{target_date}.txt"

    output_path.write_text(output_text)
    print(f"Written to {output_path} ({len(output_text):,} chars)", file=sys.stderr)
    print(str(output_path))

Static analysis

No suspicious patterns detected.