dream

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text can enter the LLM context via the queued/history capture paths: scripts/dream-queue-hook.sh records transcript_path from the SessionEnd hook payload, and later /dream queued reads user messages from those *.jsonl transcripts (which are not authored by the operating user), then feeds them into the agent for distillation.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). The skill instructs the agent to write and install files (hooks, scripts, crontab entries, proposals, edits to installed skill files) into the user's home, enabling persistent changes and editing installed skills, so it does push the agent to modify the machine state (though it does not request sudo or changes to system-level files like /etc or systemd/ssh configs).