project-memory — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-memory (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You maintain a lightweight project memory system for cross-agent, cross-session code project collaboration.
The goal is to let a new session quickly understand:
Core principle:
Fast to read, cheap to update, only record information that affects future agent decisions.
By default, respond in English and maintain memory files in English, unless the user or project requests Chinese.
Maintain at the repository root:
project-root/
├── CLAUDE.md
├── AGENTS.md
├── LOOP.md
├── BUGS.md
└── .mem/
├── project.md
├── state.md
├── decisions.md
└── handoff.mdResponsibilities:
CLAUDE.md: Claude Code entrypoint, imports AGENTS.md onlyAGENTS.md: Shared project rules entrypointBUGS.md: Lightweight bug queueLOOP.md: Long-running objectives and loop constraints.mem/project.md: Stable project facts.mem/state.md: Current progress and next steps.mem/decisions.md: Long-term ADR decisions.mem/handoff.md: Cross-session handoff recordsThis skill's core responsibility is initialization. Once initialized, AGENTS.md already contains complete work rules, update principles, collaboration rules, and security rules — these rules stay active via CLAUDE.md → @AGENTS.md as system prompts. Routine updates to .mem/state.md, BUGS.md, .mem/handoff.md etc. are driven by AGENTS.md — do NOT re-invoke this skill for them.
Only invoke this skill for:
Note: If the project lacks memory files but the user has not explicitly requested initialization, do not create the full memory system on your own. You may briefly suggest that this project is suitable for project memory initialization.
Only create the full memory system when the user explicitly requests initialization.
When the user requests initialization:
CLAUDE.mdAGENTS.mdLOOP.mdBUGS.md.mem/project.md.mem/state.md.mem/decisions.md.mem/handoff.mdCLAUDE.md with one line: @AGENTS.mdREADME.mdpackage.jsonpyproject.tomlrequirements.txtpnpm-lock.yamldocker-compose.ymlDockerfileMakefilesrc/tests/.mem/project.md.Unknown, instead put items in To Verify..mem/handoff.md.ADR-001 to .mem/decisions.md, documenting the adoption of this project memory system..env contents.Create a unique ID at each session startup:
<agent>-YYYYMMDD-HHMM-<short-id>Examples:
claude-20260504-0930-a1b2
codex-20260504-0942-b8c1
agent-20260504-1010-k7d3If the agent identity is unknown, use agent.
Before starting non-trivial work, read:
AGENTS.mdBUGS.md.mem/project.md.mem/state.md.mem/decisions.md.mem/handoff.mdLOOP.mdDo not restate all memory content to the user unless explicitly requested.
By default, only update the most relevant file. Do not update all memory files simultaneously every time.
Update triggers:
.mem/state.md: substantial progress, blockers, or next steps change.mem/handoff.md: pausing, finishing, switching context, or handing offBUGS.md: bugs are found, fixed, verified, or deferred.mem/decisions.md: long-term architecture/tool/interface decisions are made.mem/project.md: stable facts changeLOOP.md: user provides long-running objectives, loop goals, or persistent constraints.mem/handoff.md is a weak collaboration signal, not a strict lock.
If you see other recently active sessions:
.mem/handoff.md MessagesIf a session's Last Seen is older than 2 hours, unless its note explicitly says it is still working, treat it as stale and do not let it block current work.
If you are the only one working:
.mem/state.md global stateBUGS.md is a lightweight queue, not a full issue system.
Priorities:
P0: Blocks build, startup, tests, data integrity, or critical flowP1: Serious functional defectP2: Important but not blockingP3: Minor issue, optimization, cleanupStatuses:
opendoingfixedverifieddeferredwontfixRules:
Fixed instead..mem/decisions.md only records long-term decisions.
Examples of what should be an ADR:
Examples of what should NOT be an ADR:
LOOP.md can be inactive by default.
Only update LOOP.md when the user requests:
LOOP.md should not override the latest user instruction. The latest user instruction takes priority.
Memory files are plaintext and may enter git.
Never store:
.env contentsIf the user requests storing these, explain the risk and refuse to write to memory files.
If memory conflicts with code:
If memory conflicts with the latest user instruction:
File priority order:
AGENTS.mdLOOP.mdBUGS.md.mem/decisions.md.mem/state.md.mem/handoff.md.mem/project.md@AGENTS.md# AGENTS.md
## Role
You are an AI coding agent responsible for making small, correct, verifiable code changes in this repository.
By default, respond in English and maintain project memory in English, unless the user or project specifies otherwise.
## Project Memory System
This repository uses a lightweight project memory system:
project-root/ ├── CLAUDE.md ├── AGENTS.md ├── LOOP.md ├── BUGS.md └── .mem/ ├── project.md ├── state.md ├── decisions.md └── handoff.md
## Required Reads
Before non-trivial changes, read:
1. `AGENTS.md`
2. `BUGS.md`
3. `.mem/project.md`
4. `.mem/state.md`
5. `.mem/decisions.md`
6. `.mem/handoff.md`
7. If long-running objectives are involved, also read `LOOP.md`
## Work Rules
- Check relevant P0/P1 bugs in `BUGS.md` before starting a meaningful task.
- Only prioritize P0/P1 bugs relevant to the current task; unrelated bugs should not interrupt the current task.
- Update `.mem/state.md` when making substantial progress, hitting a blocker, or changing next steps.
- Update `.mem/handoff.md` when pausing, finishing, switching context, or handing off.
- Update `BUGS.md` when discovering, fixing, verifying, or deferring a bug.
- Only write to `.mem/decisions.md` for long-term architecture/tool/interface decisions.
- Only update `.mem/project.md` when stable facts change.
- Only update `LOOP.md` when the user provides long-running objectives or persistent constraints.
- By default, only update the most relevant memory file; do not update all files simultaneously for formality.
## Collaboration Rules
- Each session creates a unique ID: `<agent>-YYYYMMDD-HHMM-<short-id>`.
- `.mem/handoff.md` is a weak collaboration signal, not a strict lock.
- If you see other recently active sessions, avoid modifying the same set of files.
- If a session's `Last Seen` is older than 2 hours, unless its note explicitly says it is still working, treat it as stale.
- If overlap is unavoidable, leave a coordination note in `.mem/handoff.md`.
## Development Rules
- Read relevant source code before modifying.
- Prefer small, focused changes.
- Do not rewrite large sections without reason.
- Do not delete content the user has not explicitly asked to delete.
- Run the smallest useful verification.
- If verification is not possible, explain why and the risks.
## Security Rules
Never store API keys, passwords, tokens, private keys, `.env` contents, production secrets, or sensitive personal information in memory files.
## Completion Report
After completing meaningful work, briefly state:
1. What was changed
2. How it was verified
3. Which memory files were updated
4. What the next step is# LOOP
## Status
No active loop goal.
## Objective
-
## Done Criteria
- [ ]
## Constraints
-
## Procedure
1. Read `AGENTS.md`, `BUGS.md`, and `.mem/`.
2. Check current objective and constraints.
3. Pick the highest-impact next task.
4. Handle relevant P0/P1 bugs first.
5. Make one small verifiable change.
6. Run the smallest useful verification.
7. Update the relevant memory file.
8. Stop when done criteria or stop conditions are met.
## Stop Conditions
- Done criteria are complete.
- The next step requires user input.
- Verification fails and the cause is unclear.
- Continuing would require risky or broad architectural changes.
- Another active session is working on the same files and coordination is needed.
## Last Updated
-# BUGS
Lightweight bug queue. Check relevant P0/P1 bugs before starting a meaningful task.
Priority: P0 blocking, P1 serious, P2 important, P3 minor.
Status: open, doing, fixed, verified, deferred, wontfix.
## Open
### BUG-YYYYMMDD-001 — Title
- Priority: P1
- Status: open
- Owner: unassigned
- Area:
- Symptom:
- Repro:
- Notes:
## Fixed
### BUG-YYYYMMDD-000 — Title
- Fixed by:
- Verification:
- Notes:# Project Memory
Stable project facts. Only record verified information that affects future development decisions.
## Summary
-
## Verified Facts
-
## Tech Stack
-
## Architecture
-
## Commands
- Install:
- Dev:
- Test:
- Build:
- Lint:
- Typecheck:
## Known Pitfalls
-
## To Verify
-
## Last Updated
-# Current State
## Goal
-
## Now
-
## Progress
- [ ]
## Blockers
- None
## Next
1.
## Workstreams
- default: unassigned / idle / -
## Last Updated
-# Decisions
Only record long-term decisions that affect the future development path.
## ADR Index
- ADR-001 — YYYY-MM-DD — Use lightweight project memory — accepted
## ADR-001 — Use lightweight project memory
- Date: YYYY-MM-DD
- Status: accepted
- Owner: session-id
- Context: The project needs cross-agent, cross-session sharing of state, defects, decisions, and handoff information.
- Decision: Use `CLAUDE.md`, `AGENTS.md`, `LOOP.md`, `BUGS.md`, and `.mem/` to form a lightweight project memory system.
- Alternatives:
- Global personal memory
- Database storage
- No project memory
- Consequences:
- Agents can more easily collaborate and hand off work
- Memory must be kept concise and must avoid storing sensitive information# Handoff
Cross-session handoff records. This is a weak collaboration signal, not a strict lock.
If a session's `Last Seen` is older than 2 hours, unless its note explicitly says it is still working, treat it as stale and do not let it block current work.
## Active Sessions
| Session | Last Seen | Status | Area | Note |
|---|---|---|---|---|
| session-id | YYYY-MM-DD HH:mm | active | startup | initialized |
## Messages
- YYYY-MM-DD HH:mm — from -> to: message
## Log
### YYYY-MM-DD HH:mm — session-id
- Did:
- Changed:
- Verified:
- Blocked:
- Next:When the user asks "memory status" or "what's in the current memory":
When memory files become too long:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.