CtrlK
BlogDocsLog inGet started
Tessl Logo

memori

Ambient Memori long-term memory for Claude Code via local Bash. MUST TRIGGER on essentially every non-trivial user turn: run recall before drafting any substantive response, whether or not the user mentioned memory, a prior session, or past work. The default is to check memory first; do not wait to be asked. Always fire before external lookups (WebSearch/WebFetch) and before answering any question about preferences, prior decisions, constraints, project history, status, past work, or any non-trivial coding/research task. Skip only for trivial acknowledgements/closings, purely self-contained turns where prior context cannot possibly help, or when the user explicitly opts out. Use Advanced Augmentation after drafting the final response for every non-trivial turn, as the last memory step. Use recall.summary only for broad session summaries/orientation, compaction after context loss, feedback for memory quality, quota for limits, and signup only when explicitly requested.

SKILL.md
Quality
Evals
Security
High

W008: Secret detected in skill content (API keys, tokens, passwords).

What this means

Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.

Why it was flagged

The string `96a7ea3e-11c2-428c-b9ae-5a168363dc80` found in `index.ts:99` has high entropy and appears to be a hardcoded internal static API key or header value for authenticating requests to Memori services. It is not a placeholder and functions as a hardcoded secret in the code.

Report incorrect finding
Low

W011: Third-party content exposure detected (indirect prompt injection risk).

What this means

The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.

Why it was flagged

The Memori memory recall skill queries Memori Cloud via GET /agent/recall, which retrieves stored memories and context shared across sessions and users, exposing the agent to untrusted outsider-authored text injected into storage.

Low

W012: Unverifiable external dependency detected (runtime URL that controls agent).

What this means

The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.

Why it was flagged

The skill makes runtime HTTP requests to the third-party Memori Cloud API endpoints at api.memorilabs.ai and collector.memorilabs.ai under common/reputable unofficial provenance, establishing a medium operational dependency.

Repository
MemoriLabs/Memori
Audited
Security analysis
Snyk

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.