arise-mempalace
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to facilitate installation and configuration, including
uv tool install,pip install,mempalace init, andchmod +xto make hook scripts executable. - [DATA_EXFILTRATION]: The skill targets sensitive local data by mining conversation transcripts from
~/.claude/projects/. While the documentation emphasizes a local-first architecture with no cloud dependency, the instruction to read and process these transcripts represents a significant data access capability. - [EXTERNAL_DOWNLOADS]: The skill downloads external software, specifically the
mempalacepackage and a ~300MB embedding model, from remote repositories and registries during the setup process. - [COMMAND_EXECUTION]: The instructions require modifying
.claude/settings.local.jsonto register shell hooks (mempal-stop-hook.shandmempal-precompact-hook.sh) that automatically execute commands during specific agent lifecycle events. - [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh api) to fetch repository content and decodes it from Base64 directly into the terminal, which is an unusual method for viewing documentation.
Audit Metadata