claude-mem
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install external CLI tools and packages from third-party repositories including NPM (
claude-mem), PyPI (letta), and GitHub (thedotmack/claude-memandletta-ai/claude-subconscious). These resources are used to manage session history and memory. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to capture session interactions and inject them back into future AI contexts. This creates a surface for indirect prompt injection where malicious instructions embedded in a previous session or in processed code could be 'remembered' and executed in a subsequent session.
- Ingestion points: Captures all session activity, including user prompts, AI responses, and code changes (recorded in SKILL.md).
- Boundary markers: No specific delimiters or safety instructions are mentioned to prevent the agent from obeying instructions found within stored memories.
- Capability inventory: The skill itself provides documentation and setup commands for memory tools; it does not directly invoke dangerous system calls, but the tools it configures have broad access to session logs.
- Sanitization: There is no evidence of sanitization or filtering for the session data before it is compressed and re-injected into the prompt context.
Audit Metadata