yggdrasil-memory — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited yggdrasil-memory (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Yggdrasil is the user's durable memory across sessions, tools, and projects. Treat it as long-term memory you must consult and curate — not as a scratchpad.
reuse prior decisions/solutions instead of re-deriving them.
"what did we decide about Y".
convention) → save it so the next session/agent benefits.
Prefer the MCP tools if present, otherwise shell out to the ygg CLI (same behavior):
| Goal | MCP tool | CLI |
|---|---|---|
| Find prior work across ALL projects | ygg_recall | ygg recall --query "..." |
| Find memory scoped to one project | ygg_bootstrap / ygg_search | ygg bootstrap --project P --query "..." |
| Save a reusable memory | ygg_remember | ygg remember --project P --type T --content "..." |
| Check the engine is up | ygg_health | ygg health |
At the start of a task, query before acting:
ygg_recall(query: "<the problem in a few words>", limit: 5).query: "<topic>")`.
Skim the hits, note their provenance (source / confidence / how often used / 📌 pinned), and reuse what applies. If something contradicts the current situation, say so rather than blindly trusting it — memories are point-in-time.
When you produce something worth keeping, save one fact per memory: ygg_remember(project: "<name>", type: "<decision|lesson|convention|fix|...>", content: "<the durable fact, self-contained>").
Good candidates: a decision and its rationale, a non-obvious fix, a project convention, a gotcha that cost time. Skip: things derivable from the code, git history, or that only matter to this one conversation.
project name for saves andproject-scoped reads; use ygg_recall (no project) only for cross-project lookups.
content self-contained and specific. Convertrelative dates ("yesterday") to absolute.
common secret patterns, but don't rely on that — don't try.
whole store into the chat.
The engine may be down or the MCP/CLI not installed. Check with ygg health (or ygg_health). If it's unreachable, tell the user to run ygg start / ygg doctor, and continue without memory rather than blocking.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.