claude-mem
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPERSISTENCEMETADATA_POISONINGCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Instructions command the user or agent to run 'npx claude-mem install', which downloads and executes an unverifiable package from the public NPM registry at runtime.
- [EXTERNAL_DOWNLOADS]: The skill depends on fetching the 'claude-mem' package from the external NPM registry.
- [INDIRECT_PROMPT_INJECTION]: The core functionality involves 'auto-capture' of tool usage and 'auto-inject' of observations into future prompts. This allows data from untrusted sources (e.g., web outputs) to be stored and later injected as instructions, facilitating cross-session attacks. Evidence: 1. Ingestion points: Tool usage observations captured and stored. 2. Boundary markers: Absent from the description of context injection. 3. Capability inventory: Agent has access to Bash, Read, and Write tools. 4. Sanitization: None documented in the instruction set.
- [PERSISTENCE]: Installation configures six lifecycle hooks (SessionStart, PostToolUse, Stop, etc.) to maintain state and execution throughout the agent's lifecycle across sessions.
- [METADATA_POISONING]: The use of the name 'claude-mem' and a description that encourages installation for 'system' memory captures may lead users to believe this is an official or safer component than it is.
- [COMMAND_EXECUTION]: The skill relies on shell command execution via Bash to perform installation and memory management operations.
Audit Metadata