Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local memory-recovery helper that reads and writes disclosed local state files, with no evidence of hidden network exfiltration or destructive behavior.
Install only if you want an agent to read local memory files at session start and maintain .changsheng state files. Review the discovered paths, avoid broad must_read_extra entries, and enable the PreToolUse hook only if you want user-rule-based action blocking.
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/rule_gate.py --check "<action>"` (optional action-time
|---|---| | **Hermes** (Nous Research) | Drop into the agent's `skills/` directory, then paste `assets/agents-snippet.md` into `.hermes.md` or `AGENTS.md` → recovery runs automatically. Hermes injects SOUL/MEMORY/USER itself, and the skill detects host-injected identity and skips duplicate reads (the 55-75% cumulative case). | | **ClawHub / OpenClaw** | Dual-compatible frontmatter (standard + `metadata.hermes`). Install into the skills directory or via your hub client. | | **Claude Code / Cursor / Codex** | Copy the folder into the project or agent skills directory (`~/.claude/skills/`, etc.); instruct the agent to follow SKILL.md at session start. | | **Any LLM, any OS** | Recovery logic is pure convention + one Python stdlib script — model-agnostic; Windows / macOS / Linux; no GPU. | ## Why not just another memory plugin?
4. **L1 on-demand**: consult detail docs only when a task actually needs them. 5. **Context gauge**: report real context usage — query your platform (Hermes `/status`; Claude Code `/context`; others: see the platform table below). Never invent a percentage; if the platform exposes none, say so. Optionally append `context: N%` to your recovery report. **If `config.yaml` exists with `nudge_thresholds`, read it once and use those lines instead of the 30/50/70 defaults below** (this is how the user tunes when to be nudged). 6. **Check for a handover note**: if `.changsheng/handover.md` exists, read it first (it is the fast pointer to where the last session stopped), then **delete it** — a handover is a one-shot note; keeping it would make the third session read a stale pointer. Authority stays with todos/journal — the handover only accelerates. 7. **Report recovery honestly**: `identity ✅ (host) · rules ✅ CLAUDE.md · todos ✅ docs/TODO.md · journal ✅ journal/2026-09-04.md · rules aligned: 3 (r1 never delete without asking · r2 reply in Chinese · r3 …)`. If a role came up empty, list it explicitly — never claim a full recovery that didn't happen. ### Context threshold nudges
ChangSheng treats your rules as **memory too** — the most important kind. Two layers make them stick:
**Alignment layer (every session).** At recovery (step 2b) the agent restates the imperative rules it found in your rules files — do's and don'ts alike. You see, in plain text, that what you set is loaded. No rule file yet? Write your rules in `CLAUDE.md`/`AGENTS.md`/your rules file — plain sentences work: *"Never delete files without asking."* *"Always reply in Chinese."* *"Ask before sending anything externally."*
**Enforcement layer (where the platform supports it).** Prohibitions you never want broken ("never", "don't", "always ask first") get written to `.changsheng/rules.json` (id / text / keywords), and a tiny local gate script checks every action before it runs:rules.json schema (single source of truth — keep in sync with SKILL.md):
{
"rules": [
{"id": "r1", "text": "Never delete files without asking the user first",
"keywords": ["delete", "remove", "rm ", "unlink"]},
{"id": "r2", "text": "Never send external messages without approval",
"keywords": ["send message", "publish", "post to", "email to"]}rules.json schema (single source of truth — keep in sync with SKILL.md):
{
"rules": [
{"id": "r1", "text": "Never delete files without asking the user first",
"keywords": ["delete", "remove", "rm ", "unlink"]},
{"id": "r2", "text": "Never send external messages without approval",
"keywords": ["send message", "publish", "post to", "email to"]}rules.json schema (single source of truth — keep in sync with SKILL.md):
{
"rules": [
{"id": "r1", "text": "Never delete files without asking the user first",
"keywords": ["delete", "remove", "rm ", "unlink"]},
{"id": "r2", "text": "Never send external messages without approval",
"keywords": ["send message", "publish", "post to", "email to"]}No suspicious patterns detected.