bm-setup-15359a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bm-setup-15359a (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set up the current repo so Codex can orient from Basic Memory and checkpoint work back into it. Keep the interview short, but always ask before choosing where data will be written.
Confirm Basic Memory is reachable before changing files:
list_memory_projects.basic-memory --version or bm --version.MCP server. The plugin bundles an .mcp.json that starts uvx basic-memory mcp.
workspace, qualified name, and project id when available.
Ask the user to choose the project mapping. Do not infer write targets from the repo, default project, current directory, or previous local state.
CLI default.
focus: code/dev, research, writing, planning, or mixed.primaryProject: an existing Basic Memory project or a new one to create.secondaryProjects: optional read-only projects for session-start context.teamProjects: optional share targets for bm-share.captureFolder: default codex-sessions.rememberFolder: default codex-remember.placementConventions: a short note about where decisions, tasks, and researchnotes should land.
If there are duplicate names, show qualified names and ask the user which one to use. Prefer qualified project names or project ids for cloud projects. Never pick between cloud and local variants without confirmation.
For a new or empty project, suggest a light convention instead of creating empty folders. For an existing project, inspect list_directory and a few notes before summarizing the real convention.
After confirming the plan, write .codex/basic-memory.json in the repo:
{
"basicMemory": {
"primaryProject": "<project-ref>",
"secondaryProjects": [],
"projectMode": "cloud",
"teamProjects": {},
"focus": "<focus>",
"captureFolder": "codex-sessions",
"rememberFolder": "codex-remember",
"recallTimeframe": "7d",
"placementConventions": "<short convention>"
}
}Preserve unrelated keys if the file already exists. Include projectMode when the user chose cloud, local, or mixed routing. This file is intentionally Codex-specific; do not write .claude/settings.json.
Read the schema files from <plugin-root>/schemas/. This skill lives at <plugin-root>/skills/bm-setup/SKILL.md, so the schemas are two directories up.
Seed these schema notes into the chosen primaryProject if they do not already exist:
codex-session.mddecision.mdtask.mdUse write_note with directory="schemas", note_type="schema", schema frontmatter as metadata, and the markdown body as content. Do not paste the YAML frontmatter into content.
Before seeding schemas, restate the exact target project and ask for confirmation if it differs from the user's selected primary project or if routing is ambiguous.
Before closing, prove the mapping works:
type=schema with page size 5.Finish with the project mapping, schemas seeded or skipped, and the verification result. Tell the user that plugin hooks need to be reviewed and trusted in Codex before they run.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.