cloud-sync

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DATA_EXPOSURE]: The skill reads the application's configuration file located at ~/.claude-mem/settings.json to identify the active worker port. This is a legitimate operation for managing the specific application's state.
  • [COMMAND_EXECUTION]: The skill uses curl to interact with the local worker API at 127.0.0.1 for status checks and service restarts. It also provides instructions for the user to run npx claude-mem install in their own terminal.
  • [DYNAMIC_EXECUTION]: A node -e command is used to programmatically parse the local settings file and resolve the worker port dynamically.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from a local API endpoint (/api/sync/status).
  • Ingestion points: Worker status route via curl in SKILL.md.
  • Boundary markers: None identified in the script logic.
  • Capability inventory: Uses Bash tool for local API interaction and Read for configuration access.
  • Sanitization: No explicit sanitization of API output before reporting.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 12:11 AM