update-mem
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with a local CLI tool (
memplan-cli.js) via theBashtool. It interpolates user-supplied data, such as plan steps and facts, into command-line arguments. The skill instructions include basic guidance for the agent to escape specific delimiters (,and|) used by the CLI's internal parser. - [DATA_EXFILTRATION]: All file read and write operations are confined to the
.memplandirectory and related project memory files. The analysis found no evidence of network requests, access to sensitive system directories (like~/.ssh), or unauthorized data transmission. - [REMOTE_CODE_EXECUTION]: The skill executes a local Node.js script located within the plugin's own directory (
$CLAUDE_PLUGIN_ROOT/bin/memplan-cli.js). It does not fetch, download, or execute any third-party scripts or remote payloads.
Audit Metadata