Memory Dreaming

Autonomous memory consolidation for OpenClaw agents — like REM sleep. Periodically gathers signal from daily logs, session transcripts, and learnings; consol...

What to consider before installing: - This skill reads agent session transcripts (~/.openclaw/agents/...) and workspace files and will search for high-signal text including 'URLs' and 'API keys'. If your transcripts or notes contain secrets (API keys, passwords, tokens), the dream cycle may capture and persist them into MEMORY.md or into an Obsidian vault. If that vault is cloud-synced (Obsidian Sync, Dropbox, etc.), those secrets can be uploaded off your machine. - Recommendations before enabling automatic dreaming: - Inspect the included files (SKILL.md, scripts/*.sh, references/*) yourself — you already have them locally. Confirm you are comfortable with the exact paths it reads. - Keep obsidian.enabled=false unless you trust where the vault is stored. Prefer manual sync until you’ve validated outputs. - Run a single manual dream cycle in a controlled workspace (or test workspace) to see what the skill writes to MEMORY.md and dreaming-log.md before enabling cron. - Audit your session transcripts and workspace for secrets; consider clearing or redacting sensitive lines or reducing session retention if you don’t want those included. - Limit file-system permissions for the OpenClaw workspace or run the skill under a user that has access only to the intended directories. - Note: the scripts prompt a cron creation via OpenClaw — creating that cron enables periodic scanning; only create it if you want automatic runs. - Other notes: - The skill will update .learnings entries (mark as promoted) and write to MEMORY.md and dreaming-log.md — back up those files first if you need a restore point. - The gate script and prompt rely on file timestamps; behavior may vary on different OS/date implementations (the script attempts BSD/Linux fallbacks). If you want to proceed: disable obsidian sync or point vaultPath to a local, non-synced folder first; perform manual runs and review outputs; then consider enabling a cron with a long schedule and narrow source scope.

Type: OpenClaw Skill Name: memory-dreaming Version: 0.2.0 The skill implements an autonomous memory consolidation system that processes session logs and syncs knowledge to an Obsidian vault. It is classified as suspicious due to potential shell injection vulnerabilities within the agent instructions in `references/dream-prompt.md`, where the agent is directed to execute shell commands (e.g., `ls`, `cat`, `dirname`) using paths derived from user-controlled configuration and workspace directory names without sanitization. While the functionality is plausibly intended for memory management, the skill requires broad read access to sensitive session transcripts (`~/.openclaw/agents/main/sessions/*.jsonl`) and instructs the background agent to operate silently ('NO_REPLY'), which could mask unintended behavior if the shell commands are exploited.