Is Agent Memory safe to install?

SaferSkills independently audited Agent Memory (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/agent-memory/SKILL.md · 1 file

skills/agent-memory/SKILL.md3.8 KB · Markdown

name: Agent Memory

description: Give your agent persistent cross-session memory — recall what went wrong on similar tasks before starting, then capture whether the work succeeded or failed so repeated mistakes auto-promote into prevention rules. Runs locally via the ThumbGate MCP server (recall, capture_feedback, prevention_rules, feedback_stats) — no API key needed. Use when the user says "recall", "what went wrong last time", "remember this for next time", "capture feedback", "thumbs up/down on that", or at the start of a new task or session. Do NOT use when the user wants to force one specific mistake into an enforced block gate (use the thumbgate-guard skill), to list rules that already exist (thumbgate-rules), or to check ThumbGate wiring (thumbgate-doctor).

Agent Memory

Give your agent persistent memory across sessions. Before starting any task, recall what went wrong last time. After completing work, capture whether it succeeded or failed. Prevention rules are auto-generated from repeated mistakes.

Setup

Add the MCP server (one-time):

claude mcp add thumbgate -- npx -y thumbgate serve

No API key needed. All data stays local.

When to Use

Starting a new task or session — recall past context first
After completing work that succeeded or failed — capture feedback
When the agent keeps making the same mistake — check prevention rules

Workflow

Step 1: Recall past context (do this FIRST on every task)

Call the recall MCP tool with a description of your current task. The tool returns:

Past feedback relevant to this task (vector similarity search)
Active prevention rules (auto-generated from repeated failures)
Recent feedback summary with approval rate

Read the prevention rules carefully. These are patterns that failed before — follow them.

Step 2: Do your work

Complete the task as normal. Keep track of what you did and whether it worked.

Step 3: Capture feedback

Call the capture_feedback MCP tool:

If succeeded:

signal: up
context: What worked and why
tags: Category labels

If failed:

signal: down
context: What you were trying to do
whatWentWrong: Specific failure description
whatToChange: How to avoid this next time
tags: Category labels

Vague feedback like "it failed" will be rejected. Be specific.

Step 4: Check improvement (optional)

Call the feedback_stats MCP tool to see approval rate, top failure domains, and whether the agent is trending better or worse.

Available MCP Tools

Tool	What it does
`recall`	Search past feedback and prevention rules for current task
`capture_feedback`	Record what worked or failed with structured context
`prevention_rules`	View auto-generated rules from repeated mistakes
`feedback_stats`	Approval rate, trend analysis, top failure domains
`feedback_summary`	Human-readable summary of recent signals

MCP Profiles

Profile	Tools	Use case
`essential`	5 core tools	Default — start here
`commerce`	6 tools + commerce_recall	Agentic commerce agents
`default`	12 tools	Full pipeline including DPO export

Set profile: THUMBGATE_MCP_PROFILE=essential npx thumbgate serve

How Prevention Rules Work

Agent makes mistake A → you capture down feedback
Agent makes mistake A again → you capture down feedback again
System detects pattern → auto-generates prevention rule: "NEVER do A"
Next session → recall returns the rule → agent follows it

This is the core value. The agent doesn't learn — but it reads the rules and follows them.

Agent Memory— agent skill

Is Agent Memory safe to install?

Agent Memory

Setup

When to Use

Workflow

Step 1: Recall past context (do this FIRST on every task)

Step 2: Do your work

Step 3: Capture feedback

Step 4: Check improvement (optional)

Available MCP Tools

MCP Profiles

How Prevention Rules Work

Links

Audit the pieces. Scan the whole. Decide.