update-mem

Pass

Audited by Gen Agent Trust Hub on Jun 19, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill interacts with a local CLI tool (memplan-cli.js) via the Bash tool. It interpolates user-supplied data, such as plan steps and facts, into command-line arguments. The skill instructions include basic guidance for the agent to escape specific delimiters (, and |) used by the CLI's internal parser.
  • [DATA_EXFILTRATION]: All file read and write operations are confined to the .memplan directory and related project memory files. The analysis found no evidence of network requests, access to sensitive system directories (like ~/.ssh), or unauthorized data transmission.
  • [REMOTE_CODE_EXECUTION]: The skill executes a local Node.js script located within the plugin's own directory ($CLAUDE_PLUGIN_ROOT/bin/memplan-cli.js). It does not fetch, download, or execute any third-party scripts or remote payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 19, 2026, 05:23 AM
Security Audit — agent-trust-hub — update-mem