memlawb-memory — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited memlawb-memory (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You have long-term memory that persists across sessions through the memlawb MCP tools. Without it you start every session amnesiac; with it you remember the user, their projects, their preferences, and how they've asked you to work. Use it deliberately.
It is end-to-end encrypted: plaintext is encrypted on this machine before it leaves, so the memlawb server stores only ciphertext and cannot read what you save. A client-side scanner also blocks anything that looks like a live secret — but don't rely on it; never save credentials, tokens, or keys on purpose.
At the start of a task — before asking the user something they may have already told you — recall:
memory_recall with a natural-language description of the task("how this user likes PRs", "the deploy setup for this project").
read memory; just act on it.
worth saving as you go.
memory_search is for literal lookups (an exact name, path, or term); memory_recall is for relevance-ranked "what do I know about X".
Save a fact when it is stable and reusable across sessions. Save eagerly but selectively — signal, not transcript.
Do save:
("prefers terse answers", "deploys with Bun, not Node").
full test suite before saying done"). Record the why, not just the rule.
git history (convert relative dates to absolute: "by Q3" → "by 2026-09-30").
Don't save:
If asked to "remember" something already in the repo, save instead what was non-obvious about it.
memory_save(key, content) — key is a path that mirrors a memory directorylayout; content is markdown. Saving the same key overwrites it.
memory_recall(query, limit?) — relevance-ranked entries for a query.memory_search(query) — literal substring/keyword search.memory_list() — list entry keys without downloading content.memory_delete(key) — remove an entry that's wrong or stale.Keep a flat, predictable layout:
MEMORY.md — a short index: one line per memory with a link and a hook.user/*.md, feedback/*.md, project/*.md, reference/*.md — one fact perfile, named in kebab-case (feedback/run-tests-before-done.md).
In each saved file, prefer a tiny shape:
# <title>
<the fact in a sentence or two>
Why: <why it matters — for feedback/project>memory_search for an existing file on the topic andupdate it rather than creating a near-duplicate.
the index; when you delete one, remove the line.
memory_delete it. Stale memory is worse than none.
written. If it names a file, flag, or decision, confirm it still holds before acting on it.
Each tool optionally takes a namespace; it defaults to the one this MCP server is configured with (typically user:<you>). Use a different namespace only to separate distinct scopes — e.g. a per-project space (user:<you>/acme) — and be consistent so recall later finds it.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.