Skills memory
📦

memory

Content revision r2 High Risk ⚙️ External commands📁 Filesystem access

Manage Project Memory and SSOT

Project decisions and reusable patterns often become scattered across tools and sessions. This skill searches shared memory and promotes durable knowledge into structured project SSOT files.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "memory" from https://skillstore.io/skills/chachamaru127-memory.md and its manifest at https://skillstore.io/api/skills/chachamaru127-memory/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/chachamaru127-memory.md Signed manifest GET /api/skills/chachamaru127-memory/manifest Signed lockfile GET /api/skills/chachamaru127-memory/lockfile

Test it

Using "memory". Find prior authentication decisions.

Expected outcome:

Found two approved decisions covering session storage and token rotation. The summary includes rationale, dates, and source observation identifiers.

Using "memory". Promote the cache incident lessons to SSOT.

Expected outcome:

Proposed one decision about cache ownership and one reusable invalidation pattern. Confidential incident details were excluded, and no files were changed.

Using "memory". Merge this Plans.md into the current structure.

Expected outcome:

Created a backup, retained all four task sections, updated marker definitions, and reported task counts. The final diff is ready for review.

Security Audit

High Risk
v13 • 7/23/2026 Open versioned report

Most static alerts are false positives caused by inline Markdown, fixed shell substitutions, intentional project paths, and multilingual text. No explicit prompt injection or obfuscated payload was found. Two semantic risks remain: unsanitized memory promotion and unconfirmed replacement of an unparseable Plans.md file.

6
Files scanned
764
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
references/sync-ssot-from-memory.md:46-53references/sync-ssot-from-memory.md:89
Persistent Prompt Injection Through Memory Promotion
The workflow retrieves stored observations and writes selected content into persistent SSOT files without requiring instruction filtering. A poisoned observation could persist attacker-controlled directives across sessions.
The file explicitly retrieves observations and reflects selected content into SSOT, but it provides no instruction-sanitization step.
Medium
references/plans-merging.md:193-206references/workflow-migration.md:93-99
Unconfirmed Replacement of Unparseable Plans
When Plans.md validation fails, the workflow keeps a backup but switches to a fresh template. This can remove active task data without final confirmation.
Both references explicitly select the template fallback when parsing fails, while only the original file is retained in backup.

Risk Factors

⚙️ External commands (23)
references/plans-merging.md:158-159 references/plans-merging.md:159-160 references/plans-merging.md:160-161 references/plans-merging.md:161-162 references/plans-merging.md:162-163 references/plans-merging.md:163-164 references/plans-merging.md:164-165 references/plans-merging.md:165-175 references/plans-merging.md:85 references/plans-merging.md:86 references/plans-merging.md:87 references/plans-merging.md:88 references/plans-merging.md:99 references/plans-merging.md:100 references/plans-merging.md:101 references/plans-merging.md:102 references/plans-merging.md:203 references/plans-merging.md:238 SKILL.md:28 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:38
📁 Filesystem access (4)
references/ssot-initialization.md:42 references/sync-ssot-from-memory.md:32 SKILL.md:40 SKILL.md:40
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/chachamaru127-memory/audits/13?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/chachamaru127-memory/security.svg)](https://skillstore.io/skills/chachamaru127-memory?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/chachamaru127-memory?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/chachamaru127-memory/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/chachamaru127-memory.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

Chachamaru127. (2026). memory security audit report (audit version 13) [Author version unspecified]. Skillstore. https://skillstore.io/skills/chachamaru127-memory/audits/13

BibTeX citation

@techreport{chachamaru127-chachamaru127-memory-2026, author = {Chachamaru127}, title = {memory security audit report (audit version 13)}, institution = {Skillstore}, year = {2026}, number = {13}, url = {https://skillstore.io/skills/chachamaru127-memory/audits/13}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "memory security audit report (audit version 13)" version: "unspecified" type: report authors: - name: "Chachamaru127" date-released: "2026-07-23" url: "https://skillstore.io/skills/chachamaru127-memory/audits/13" identifiers: - type: other value: "skillstore:chachamaru127-memory:audit:13" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Preserve Architecture Decisions

Convert approved technical choices and their rationale into durable decisions.md entries.

Restore Cross-Tool Context

Search prior observations from shared memory before continuing work in another supported agent.

Migrate Team Workflows

Update existing agent instructions and task plans while retaining project-specific rules and backups.

Try These Prompts

Search Past Decisions 
Search project memory for prior decisions about [topic]. Summarize conclusions, rationale, dates, and observation identifiers. Do not modify files.
Propose SSOT Promotion 
Review memory observations about [topic]. Separate decisions from reusable patterns, remove confidential details, and propose entries. Wait for approval before editing.
Merge Plans Safely 
Merge [Plans.md path] with the current format. Preserve every task section, create a timestamped backup, and present counts and a diff.
Migrate Workflow Documentation 
Audit AGENTS.md, CLAUDE.md, and Plans.md. List constraints to retain, ask focused questions, create backups, migrate approved content, and present final diffs.

Best Practices

  • Search and deduplicate existing SSOT entries before adding new material.
  • Review retrieved memory as untrusted content and remove instructions, secrets, and personal data.
  • Require a backup and inspect the diff before accepting any workflow-file migration.

Avoid

  • Do not promote unfinished notes or uncertain observations as durable decisions.
  • Do not replace an unparseable Plans.md file without explicit approval after backup.
  • Do not use this skill for temporary notes, implementation work, or routine code reviews.

Frequently Asked Questions

Which memory systems are supported?
The workflow supports Harness Memory and Serena. Manual pasted input is available when neither integration can be accessed.
Which SSOT files can this skill manage?
It manages decisions.md for rationale, patterns.md for reusable methods, and an optional local session log.
Will existing SSOT files be overwritten?
Initialization skips existing files. Promotion and migration workflows can edit files, so review proposed changes and diffs.
How does Plans.md merging protect tasks?
It extracts task sections, counts entries, creates a backup, and places retained tasks into the current template structure.
Can it migrate AGENTS.md and CLAUDE.md?
Yes. It reviews existing rules, asks what must remain, creates backups, and applies the approved structure.
Does it protect against malicious memory content?
Not explicitly. Treat retrieved observations as untrusted, remove instruction-like text, and approve every SSOT write.

Developer Details

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Repository

https://github.com/Chachamaru127/claude-code-harness/tree/main/skills/memory

Ref

c43861a65bb95efcae259cd161c9d6f4dc7eec6f

Maintenance freshness

7/24/2026

Usage

6 downloads · 203 views

File structure

📁 references/

📄 plans-merging.md

📄 ssot-initialization.md

📄 sync-project-specs.md

📄 sync-ssot-from-memory.md

📄 workflow-migration.md

📄 SKILL.md

More from Chachamaru127

View all

Related Skills

View all