bm-status-17654a — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bm-status-17654a (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Report the plugin's current state for this project, then present a concise summary. This is a quick diagnostic — gather the facts and lay them out; don't over-investigate.
When no project is pinned, discover projects with bm_project(command="list") and pass the selected project's external ID as project on note/search calls. With several addressable projects, these calls require an explicit scope even when a default is configured.
basic-memory --version, then bm --version, thenuvx --prerelease=allow basic-memory --version. If no launcher resolves, report the CLI status as unavailable and continue with MCP/config checks. The plugin hooks can still use their uv-managed environment.
basicMemory block with the hooks' precedence.For the user-level base, append settings.json to the literal value of CLAUDE_CONFIG_DIR when that environment variable is present; do not trim it, expand ~, or treat an empty value as unset. Use ~/.claude/settings.json only when the variable is absent. Then the project's .claude/settings.json and .claude/settings.local.json override per key. Report the result, noting when a value comes from the user-level block versus the project:
basicMemory block: primaryProject (or note none is pinned — thelisted default or sole project is selected explicitly), secondaryProjects (team/shared read sources), teamProjects (share targets for /basic-memory:bm-share), captureFolder (default sessions), rememberFolder (default bm-remember), preCompactCapture mode (default extractive), sessionProfile (default general), repository (coding profile only), captureEvents (default true).
basicMemory): whether outputStyle isbasic-memory — i.e. whether the capture reflexes are on.
basic-memory hook status --harness claude --project-dir <project-root>. Report its shared inbox path, pending envelopes, archived envelopes, pending checkpoint requests, last flush, settings state, resolved primary project, capture state, capture folder, Basic Memory version, and uv version. Inbox counts are global across supported harnesses; do not attribute a backlog solely to Claude. Treat this command's settings resolution as canonical for hook behavior; if it disagrees with the manually merged config, show the mismatch. If no launcher resolves, mark these fields unavailable and continue.
bm_search withfilters={"type": "session"}, page_size 5, scoped to primaryProject if one is set. When sessionProfile is coding, also query filters={"type": "coding_session", "repository": "<configured repository>"}, then merge, deduplicate, sort newest first, and keep the newest five. List them by title + permalink.
bm_search withfilters={"type": "task", "status": "active"} — report just the count.
When scoping these queries to primaryProject, pass it as project, including when it is an external_id UUID.
Lay it out like this (fill in real values; write "—" or a short note for anything you couldn't determine, rather than failing the whole report):
## Basic Memory status
- CLI: basic-memory <version>
- Project: <primaryProject, or "discovered project (not pinned)">
- Reads from (team): <secondaryProjects joined, or "none">
- Share targets: <teamProjects keys joined, or "none">
- Capture folder: <captureFolder>
- Remember folder: <rememberFolder>
- Output style: <enabled | not enabled>
- PreCompact: <mode>
- Session profile: <general | coding>
- Repository: <owner/name or none>
- Event capture: <enabled | disabled>
- Shared hook inbox: <path or unavailable>
- Shared pending envelopes: <count or unavailable>
- Shared archived envelopes: <count or unavailable>
- Pending checkpoint requests: <count or unavailable>
- Last flush: <timestamp, never, or unavailable>
- Hook runtime: basic-memory <version>; uv <version or missing>
- Recent checkpoints: <n across session and coding_session>
- <title> — <permalink>
...
- Active tasks: <n>If there are no checkpoints yet, say "none yet" and remind the user that checkpoints are written automatically before context compaction (and that a primaryProject must be set for them to be written).
Warn when event capture is enabled and pending envelopes are accumulating or the last flush is never, while noting that another harness may contribute to the shared counts. Do not warn about an empty inbox when capture is disabled.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.