Simplemem

PassAudited by ClawScan on May 10, 2026.

Overview

Simplemem appears consistent with a memory skill, but it persistently stores memories and can use an OpenAI API key through an external package.

Before installing, decide whether you want a persistent memory store for this agent, avoid saving secrets, and review the external SimpleMem package or pin its version if you enable the OpenAI-backed semantic features.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Information saved as memory may reappear in future conversations and could affect later agent behavior.

Why it was flagged

The wrapper persistently stores user-provided memory content in a JSON file under the skill's data directory, which is expected for this skill but can retain sensitive or incorrect context across sessions.

Skill content
self.data_dir = data_dir or Path(__file__).parent / "data" ... memories[user_id].append(memory) ... json.dump(memories, f, ensure_ascii=False, indent=2)
Recommendation

Only store information you are comfortable retaining, and periodically review or clear the memory data directory if the skill supports or allows it.

What this means

Using the full feature mode may consume OpenAI account quota and may send memory content or queries to the provider through the SimpleMem library.

Why it was flagged

The skill reads an OpenAI API key from the environment and passes it into the SimpleMem configuration for full semantic-memory features.

Skill content
self.api_key = api_key or os.getenv("OPENAI_API_KEY", "") ... config.openai_api_key = self.api_key
Recommendation

Use a dedicated API key where possible, monitor usage, and avoid storing secrets or highly sensitive personal data as memories.

What this means

The behavior of the installed dependency could change over time or differ from the small wrapper reviewed here.

Why it was flagged

The documented installation path pulls external code and dependencies without pinned versions, so the reviewed artifacts do not fully cover all code that may run in full-feature mode.

Skill content
pip install simplemem ... git clone https://github.com/aiming-lab/SimpleMem.git ... pip install -r requirements.txt
Recommendation

Install from a trusted source, consider pinning package versions or commit hashes, and review the external SimpleMem package before enabling full features.