agent-memory-implementation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agent-memory-implementation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Restructures memory files into the 2-layer architecture that Claude Code's autoDream service uses internally — designed to keep the always-loaded index small while making deeper knowledge accessible on demand.
Claude Code's memory system (services/autoDream/) uses this structure:
MEMORY.md ← Layer 1: Always loaded, pointer-only index (~200 lines max)
├── topic-file.md ← Layer 2: Domain knowledge, loaded when relevant
└── another-topic.mdLayer 1 — MEMORY.md index: Loaded into every conversation. Must stay under ~200 lines (lines beyond 200 get truncated). Each entry is a one-line pointer: - [Title](file.md) — one-line hook. No content, just pointers. This is what Claude scans to decide what to load.
Layer 2 — Topic files: Contain the actual knowledge. Claude loads these on demand when their pointer appears relevant. Can be as long as needed. Each file has YAML frontmatter with name, description, and type.
No archive layer: The autoDream system does not maintain an archive directory. Stale, superseded, or contradicted memories are deleted or corrected in place (see consolidationPrompt.ts Phase 3–4). The memory directory is always the current truth, not a history log.
Understanding the auto-extraction pipeline helps you restructure files in a way that works with the system rather than against it.
At the end of every query loop (when the model returns a final response with no pending tool calls), Claude Code fires a forked agent in the background via executeExtractMemories() in services/extractMemories/extractMemories.ts. This agent:
description field is the primary signal).md files inside the memory directory, then updates MEMORY.mdThe fork shares the parent conversation's prompt cache (same tool list, same system prompt prefix, same cache key), so the extra token cost is near zero.
Mutual exclusion: if the main agent already wrote to the memory directory during the conversation (e.g., the user said "remember this"), the forked agent detects that and skips — no double-writes.
Turn budget: hard cap of 5 turns. The agent is instructed to batch all reads in turn 1 and all writes in turn 2 — no interleaving.
services/extractMemories/prompts.ts)The prompt is assembled by buildExtractAutoOnlyPrompt() in four parts:
Part 1 — Role + tool constraints + efficiency strategy (hardcoded)
You are now acting as the memory extraction subagent.
Analyze the most recent ~{N} messages above and use them to update
your persistent memory systems.
Available tools: Read, Grep, Glob, read-only Bash (ls/find/cat/stat/
wc/head/tail), and Edit/Write for paths inside the memory directory
only. Bash rm is not permitted.
Turn budget strategy:
turn 1 — issue all Read calls in parallel for every file you might update
turn 2 — issue all Write/Edit calls in parallel
You MUST only use content from the last ~{N} messages.
Do not grep source files, read code to confirm patterns, or run git commands.Part 2 — Existing memory manifest (injected dynamically)
## Existing memory files
- [feedback] feedback_testing.md: no DB mocks in integration tests
- [user] user_role.md: user is a PM learning the codebase
- ...
Check this list before writing — update an existing file rather than
creating a duplicate.Generated by scanMemoryFiles() scanning each file's frontmatter. The description field in your frontmatter is this manifest line — if it's vague, the agent can't tell whether to update the file or create a new one.
Part 3 — Four memory types + What NOT to save (shared with system prompt)
Uses the same constants (TYPES_SECTION_INDIVIDUAL, WHAT_NOT_TO_SAVE_SECTION) from memdir/memoryTypes.ts that appear in the main agent's system prompt. One source of truth — the extraction agent uses the same criteria the main agent uses.
Part 4 — How to save (two-step write spec)
Step 1 — write topic file with frontmatter:
---
name: <slug>
description: <one-line summary — used for relevance matching>
type: user | feedback | project | reference
---
Step 2 — add one pointer line to MEMORY.md:
- [Title](file.md) — one-line hook— is what Claude reads to decide whether to load the full file. A hook that just says "misc notes" wastes the slot.Read references/memory-type-definitions.md for the verbatim XML from memdir/memoryTypes.ts — the four type specs (user, feedback, project, reference) and the exclusion list. Load it when deciding what to extract from a conversation and which type to assign to each memory.
Read MEMORY.md and all memory files in the same directory. Catalog:
For each piece of content, decide its layer:
| Content type | Layer |
|---|---|
| Universal facts, always-relevant rules | L1 pointer → L2 file |
| Project-specific decisions, current constraints | L1 pointer → L2 file |
| Historical "why we did X" context | Condense into relevant L2 file or delete |
| Superseded approaches | Delete |
| Contradicted facts | Delete or correct at source |
| Step-by-step implementation details | Delete (code is the record) |
For MEMORY.md:
- [Descriptive Title](filename.md) — one-line hook (what makes this relevant?)## Architecture, ## User preferences)For topic files:
---
name: <topic name>
description: <one-line — used to judge relevance in future conversations>
type: user | feedback | project | reference
---feedback type: lead with the rule, then **Why:** and **How to apply:** linesproject type: lead with the fact/decision, then **Why:** and **How to apply:**After restructuring:
Tell the user:
Bloated index — MEMORY.md has paragraphs of content instead of pointers. Extract to topic files.
One giant file — Everything dumped into a single memories.md. Split by topic.
Missing frontmatter — Topic files without name/description/type. Add it — the description is what helps Claude decide whether to load the file.
Stale facts — Memory says "using postgres 14" but codebase shows 16. Fix at source.
Temporal decay — "We decided last week to use X". Convert to absolute date; also verify if decision still stands.
Historical context in index — Old decisions or "why we did X" cluttering MEMORY.md. Either condense the rationale into the relevant topic file's **Why:** line, or delete if no longer relevant.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.