Remembering Conversations

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEPERSISTENCEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PERSISTENCE]: The tool/install-hook script installs a persistent hook at ~/.claude/hooks/sessionEnd. This hook automatically triggers the indexing process in the background after every Claude Code session concludes.
  • [EXTERNAL_DOWNLOADS]: The skill uses the @xenova/transformers library to download the Xenova/all-MiniLM-L6-v2 embedding model from Hugging Face during its initial run to enable local vector search.
  • [DATA_EXFILTRATION]: Conversation logs from ~/.claude/projects (which may contain sensitive code, architectural decisions, or credentials) are sent to Anthropic's APIs to generate AI summaries that facilitate search.
  • [INDIRECT_PROMPT_INJECTION]: The skill indexes arbitrary conversation history which could contain malicious instructions. These instructions could attempt to influence the 'Search Agent' subagent's behavior when it processes and synthesizes search results.
  • Ingestion points: Reads .jsonl files from ~/.claude/projects/ and ~/.config/superpowers/conversation-archive/.
  • Boundary markers: The tool/prompts/search-agent.md template includes 'Critical Rules' instructing the agent to synthesize findings and avoid raw conversation excerpts to minimize context pollution.
  • Capability inventory: Background shell execution via npx tsx, file archival/writes, and network requests to Anthropic's API for summarization.
  • Sanitization: No explicit sanitization of conversation content before it is processed by the summarizer or indexed.
  • [COMMAND_EXECUTION]: The skill utilizes the sqlite-vec package, which involves loading a native binary extension into the SQLite database at runtime to perform vector similarity calculations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:22 AM