Hermes Memory Sync

AdvisoryAudited by Static analysis on May 4, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private chat content, decisions, and tool-use details may be preserved in Markdown files and could influence future memory use if those files are loaded later.

Why it was flagged

This confirms the skill intentionally converts Hermes conversation history into persistent readable memory files.

Skill content
Reads session JSON/JSONL files, groups conversations by day, extracts key topics/decisions/tools used, and writes structured summaries to `workspace/memory/YYYY-MM-DD.md`.
Recommendation

Run it only on logs you are comfortable persisting, store the output in a private directory, and review or redact generated memory files if sessions may contain secrets.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If the cron job is created, the sync will continue running daily and writing memory files without a new manual command each time.

Why it was flagged

The skill documents an optional scheduled job that runs the memory sync every day.

Skill content
cronjob action=create name="memory-sync-daily" ... schedule="0 3 * * *"
Recommendation

Create the cron job only if you want ongoing daily summaries, and know how to disable or delete the job when no longer needed.

What this means

Users have less external context for verifying the script's origin, even though the provided artifacts are coherent and the static scan is clean.

Why it was flagged

The registry metadata does not provide an upstream source or homepage for independent provenance checking.

Skill content
Source: unknown; Homepage: none
Recommendation

Inspect the included script before running it and prefer a trusted source or pinned copy if deploying it broadly.