ClawHub
Back to skill

Security audit

Dreaming Extractor

Security checks across malware telemetry and agentic risk

Overview

This skill transparently turns local OpenClaw session history into local persistent memory, which is privacy-sensitive but matches its stated purpose.

Install only if you want prior OpenClaw conversations summarized into persistent local memory. Before enabling the daily cron, consider whether your session history may contain secrets, client data, personal information, or confidential project details, and periodically review or delete memory/.dreams and memory/learned.md.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs use of Python scripts that read session data and write persistent files, but it does not declare permissions for those file and environment capabilities. Undeclared capabilities reduce transparency and consent, making it easier for a user or platform to underestimate what the skill can access and modify.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The declared purpose focuses on fact extraction into learned.md, but the documented behavior also performs budget tracking, history logging, session collection, and intermediate-file storage under memory/.dreams. This mismatch is dangerous because it obscures the full data lifecycle and side effects, especially around retention of conversation data and operational logs.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill processes real agent conversation history and writes extracted facts into a persistent memory file, yet it does not prominently warn that private session content may be scanned, transformed, and retained. This creates a privacy and data-governance risk because users may not realize sensitive personal, business, or credential-adjacent information could be captured in long-term memory.

Ssd 3

Medium
Confidence
96% confidence
Finding
The skill is explicitly designed to read real conversations and persist derived facts into long-term memory, which can convert transient chat content into durable records without robust minimization. In this context, the danger is elevated because agent sessions often contain sensitive operational details, user corrections, internal decisions, and other private context that was not necessarily intended for durable storage.

Ssd 3

Medium
Confidence
97% confidence
Finding
The extraction rules encourage retaining corrections, configuration changes, external facts, and other details from real sessions, which increases the likelihood that sensitive or proprietary information will be codified into persistent memory. Because these rules are broad and confidence-based rather than sensitivity-based, the system may store private data that is accurate and useful but still inappropriate to retain long term.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.