bm-share-4bc4fc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bm-share-4bc4fc (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Copy a note from the personal/primary project into a configured team project so teammates can see it. This is the only path by which the plugin writes to a shared project — session checkpoints and /basic-memory:bm-remember always stay personal.
.claude/settings.json (+ .local) basicMemory:teamProjects — a map of <project-ref> → { "promoteFolder": "shared" }.These are the allowed share targets. <project-ref> is a workspace-qualified name (e.g. my-team-2/notes) or an external_id UUID.
primaryProject — the source project notes are read from.If teamProjects is empty, tell the user there's no share target configured and suggest adding one (or running /basic-memory:bm-setup), then stop. Don't invent a target.
$ARGUMENTS (a title, permalink, or memory://URL), read_note it from primaryProject. If $ARGUMENTS is empty (you were invoked from "share this"), use the note most clearly referenced in the conversation — confirm which one if there's any ambiguity. Capture its title, full content (including frontmatter), and source permalink.
teamProjects has one entry, use it. If several, askwhich team project to share to. Use that entry's promoteFolder (default shared).
what you're about to do — "Share '<title>' to <target>/<promoteFolder>?" — and wait for a yes. Never share silently.
write_note:external_id UUID, pass it asproject_id; otherwise pass the workspace-qualified name as project. (A bare UUID in project won't route — Basic Memory takes UUIDs only via project_id.)
directory = the promoteFoldertitle = the source titlecontent = the source's content, with attribution added: keep its frontmatter(so a shared decision stays type: decision and is findable in the team's structured recall), add a shared_from: <source permalink> frontmatter field, and add an observation - [context] Shared from <source permalink>. Don't overwrite an existing note at the target unless the user says so.
Shared → my-team-2/shared/<slug>.
don't propagate to the other.
want teammates to see — if in doubt, ask.
the project (qualified name) or project_id (UUID) argument.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.