Security audit
Security checks for vulnerabilities and agentic risk
This persistent-memory skill is purpose-aligned but needs review because it silently stores conversation-derived data and uses unpinned remote installation paths despite claiming zero network.
Install only after reviewing the installer and preferably using a pinned, checksummed release. Treat the memory store as durable local records: avoid using this skill around secrets, tokens, private URLs, personal data, or confidential project details unless you have confirmed how to review and delete saved notes. The artifact is not clearly malicious, but its installation and automatic persistence behavior need explicit user control.
SKILL.md:38Mutable Remote Installer Is Piped Directly Into a Shell
scripts/install.sh:61Installer Downloads and Executes an Unverified Mutable Release Binary
SKILL.md:103Skill Silently Persists Potentially Sensitive Conversation and Environment Information
commands/save-session.md:23Generated Conversation Content Is Embedded in Shell Command Templates
The skill claims to be 'All local, zero network' while directing users/agents to fetch and execute a remote GitHub installer, then run an installed binary. That mismatch can mislead users and agents into trusting behavior they would otherwise scrutinize, enabling supply-chain compromise or unexpected host modification.
curl ... | bash is a classic high-risk pattern because it combines remote retrieval and execution in one step with no opportunity for inspection or integrity validation. In this skill, the danger is amplified by the misleading 'zero network' framing, which may lower user suspicion and lead to arbitrary code execution on the machine.
Before first use, verify the CLI is installed. If claudemem is not found on PATH, install it:
curl -fsSL https://raw.githubusercontent.com/zelinewang/claudemem/main/skills/claudemem/scripts/install.sh | bash
Or run the bundled installer:
The skill instructs automatic note-saving during normal conversation without prior warning or consent, which can persist sensitive user data, secrets, internal URLs, or project details. A brief post-save indicator is insufficient because the privacy-sensitive action has already occurred.
The skill instructs the agent to review the entire conversation and persist important knowledge, including user preferences, without any privacy notice, consent gate, or per-item confirmation. This creates a real risk of storing sensitive personal, proprietary, or contextual information beyond the user's expectations, with cross-session privacy impact.
The installer contradicts the skill's 'All local, zero network' claim by downloading a binary from GitHub and, on fallback, fetching and building code from a remote repository via 'go install ...@latest'. This creates a supply-chain risk because installation depends on mutable remote content and can execute unreviewed code or install a tampered release if the upstream account, release artifacts, or dependency chain are compromised.
The '| bash' chaining pattern is a direct remote-code-execution mechanism: data retrieved over the network is piped straight into a shell interpreter. In the context of an installer, this materially increases risk because the skill is effectively asking users to trust and run unaudited network content, which is especially concerning given the metadata's 'All local, zero network' representation.
#!/bin/bash
# claudemem universal installer
# Usage: curl -fsSL https://raw.githubusercontent.com/zelinewang/claudemem/main/skills/claudemem/scripts/install.sh | bash
set -e
The skill clearly instructs shell execution (curl ... | bash, bash "SKILL_DIR/scripts/install.sh", and repeated claudemem CLI invocations) but does not declare any tool scope or allowed-tools restrictions. This increases the chance an agent will execute shell commands without explicit capability boundaries or user awareness, which is risky in a skill that also performs autonomous actions.
Advertising 'All local, zero network' while embedding a curl download-and-execute setup command is deceptive and weakens informed consent. Users may permit the skill under a false assumption that no external communication or remote code retrieval occurs.
Broad natural-language triggers such as 'remember this', 'save this', or 'wrap up' can easily appear in ordinary conversation and unintentionally activate persistence operations. In a memory skill, ambiguous activation is particularly risky because it can cause sensitive or incidental data to be stored without deliberate user intent.
Automatic wrap-up before session end is less severe than silent note capture because it is conditioned on user configuration, but it still authorizes autonomous persistence actions. If the configuration is enabled without careful understanding, the agent may save summaries and extracted knowledge the user did not intend to retain.
### Recommended: Auto Wrap-Up Before Session Ends
If the user has enabled auto wrap-up in their CLAUDE.md, automatically execute /wrap-up before the conversation ends:
1. Extract unsaved knowledge fragments → save as notes (with dedup)
2. Generate session summary → save as session
3. Show brief report of what was saved
Autonomous saving 'without asking' delegates privacy-sensitive decisions to the agent, which may misclassify information as safe to retain. In a memory skill, that autonomy directly affects long-term data retention and can store confidential material beyond the user's intent.
Automatically capture knowledge without asking during normal conversation. After saving, add a brief indicator at the end of your response so the user knows what was captured:
The skill directs the agent to persist user-provided and session-derived information 'without asking first', creating a privacy and data-governance risk. Because the content is meant to survive across conversations, unintended storage can compound over time and expose more context than the user expected.
The workflow explicitly creates, updates, and appends persistent session-related content, which creates retention risk when combined with autonomous extraction. While persistence is central to the skill's purpose, the danger comes from storing data across sessions without robust consent, minimization, and review controls.
**How to auto-save gracefully:**
1. Identify the knowledge fragment during your normal response
2. Choose an appropriate category (create new if none fits)
3. Before saving, quickly search to avoid duplicates: `claudemem note search "keyword" --format json`
4. If related note exists: `claudemem note append <id> "new info"` instead of creating duplicate
5. Save: `claudemem note add <category> --title "..." --content "..." --tags "..."`
This command is explicitly designed to retrieve and display persistent memory, including recent sessions and note contents, but it provides no warning, consent boundary, or sensitivity filtering before exposing stored data back to the user. Because memory may contain prior conversation summaries, preferences, API details, or other sensitive context, an unsuspecting user could trigger disclosure of information they did not intend to reveal in the current session.
The command instructs the agent to save the entire conversation history into persistent memory, but it does not require an explicit user-facing warning or consent flow before storing potentially sensitive content. Because this skill is specifically designed for durable cross-session memory, users may unintentionally persist secrets, personal data, internal project details, or other confidential material beyond the current session.
The command is framed as a broad end-of-session action and can plausibly trigger on ordinary wrap-up phrasing, causing memory writes without a narrowly scoped, explicit user action. In a persistent-memory skill, ambiguous invocation increases the chance of unintended storage of sensitive or private conversation content.
The command directs the agent to persistently store broad conversation-derived information, including learned preferences and 'everything important,' which is overly expansive for memory collection. Even without network exfiltration, local persistent storage can accumulate sensitive behavioral and project data that may later be surfaced or misused across sessions.
Fetching an external script from GitHub at install time introduces a supply-chain risk: the remote content can change, be compromised, or be substituted in transit by a trusted-but-malicious source. Because the script is immediately executed, any compromise yields code execution on the host.
Before first use, verify the CLI is installed. If claudemem is not found on PATH, install it:
curl -fsSL https://raw.githubusercontent.com/zelinewang/claudemem/main/skills/claudemem/scripts/install.sh | bash
Or run the bundled installer:
The documented installation method tells users to fetch a shell script directly from GitHub and execute it immediately. This is dangerous because it bypasses review of the script contents and turns any compromise of the repository, branch, hosting path, or transport endpoint into immediate code execution on the user's machine.
#!/bin/bash
# claudemem universal installer
# Usage: curl -fsSL https://raw.githubusercontent.com/zelinewang/claudemem/main/skills/claudemem/scripts/install.sh | bash
set -e