how-it-works
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill files consist entirely of Markdown documentation. There are no executable scripts (.py, .js, .sh), dynamic code execution patterns, or complex prompt instructions that could be used for malicious purposes.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The documentation describes the tool's use of a local directory (~/.claude-mem) for storing SQLite databases and vector indexes. It transparently discloses that network communication is limited to configured AI providers and a one-time signup via the vendor's domain (cmem.ai).
- [EXTERNAL_DOWNLOADS]: The documentation references the command 'npx claude-mem uninstall', which is a standard procedure for managing the Node.js package associated with the tool.
Audit Metadata