knowledge-management — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited knowledge-management (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
CRITICAL: Memory is for knowledge NOT derivable from the current project state. If you can grep for it or read it from CLAUDE.md, don't save it as memory.
Four types of knowledge, each with distinct purpose and storage rules:
<types> <type>
user — Who the user is, their role, expertise, preferences, and how to tailor your work to them.
</type>
<type>
feedback — Guidance on how to approach work. Both corrections ("don't do X") AND confirmations ("yes, keep doing that").
</type>
<type>
project — Ongoing work, goals, initiatives, and decisions NOT derivable from code or git history.
</type>
<type>
reference — Pointers to where information lives in external systems.
</type> </types>
These exclusions apply even when the user explicitly asks. If they ask to save a PR list or activity summary, ask what was surprising or non-obvious about it — that's the part worth keeping.
git log / git blame are authoritative---
name: {{descriptive name}}
description: {{one-line description — used to decide relevance in future conversations, so be specific}}
type: {{user, feedback, project, reference}}
---
{{content — for feedback/project types, use rule + Why + How to apply structure}}A memory that names a specific function, file, or flag is a claim that it existed when the memory was written. It may have been renamed, removed, or never merged.
"The memory says X exists" is not the same as "X exists now."
A memory that summarizes repo state is frozen in time. If the user asks about recent or current state, prefer git log or reading the code over recalling a snapshot.
Knowledge sources load in this order, with later sources taking higher priority:
When sources conflict, trust the higher-priority (later-loaded) source. If a project rule contradicts a global rule, the project rule wins.
| Destination | What Belongs |
|---|---|
| CLAUDE.md | Project conventions all contributors should follow |
| CLAUDE.local.md | Personal instructions specific to this user |
| Auto-memory | Working notes, temporary context, uncertain patterns |
When reviewing memories, check for:
CRITICAL REMINDER: Only save what can't be derived from the current project state. Verify memories against current reality before recommending. Propose changes — don't apply them without approval.
context-summarization produces structured session summaries that inform what should become durable memory.session-handoff extends memory into cross-session continuity with template-based notes.codebase-exploration patterns help verify memory claims against current code state.If user-config.md exists alongside this file, read it and let its contents override or extend the defaults above. Common customizations:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.