Agent Memory Blueprint: public-safe templates, validators, and skill packaging for machine-first long-running agent memory.
SaferSkills independently audited agent-memory-blueprint (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Treat agent memory as a bootable knowledge system, not as notes.
Use this skill to:
Do not use this skill to:
--strict-public as a perfect leak detectorBuild four layers:
agent_boot, read_profiles, project_skill_cards, project_indexcurrent_state, next_action, paths, and do-not rulescalendar_events_YYYY_MM sections for reports and retrospectivesUse multi-document YAML only when helpful. Top-level keys must be unique within and across documents.
Run:
python scripts/analyze_memory_shape.py /path/to/memory.yaml --jsonUse the report for structural facts only: top-level keys, read profiles, project cards, detail links, calendar sections, duplicate top-level keys, and public-risk marker counts. Do not copy live project content into public templates.
references/architecture.md for the four-layer model.references/schema.md and schemas/memory.schema.json for field contracts.references/update-protocol.md when editing a live private memory file.references/publication.md before preparing public GitHub content.Run:
python scripts/scaffold_memory.py --output /path/to/memory.yaml --owner OWNER_NAMEThe scaffold is synthetic. Replace it with real project cards only in private files outside the public repository.
Run:
python scripts/validate_memory.py /path/to/memory.yamlBefore publishing:
python scripts/validate_memory.py /path/to/memory.yaml --strict-public
python scripts/release_check.pyStrict-public fails likely emails, phone-like content, recruiting/profile URLs, secret-like assignments, and non-placeholder local paths such as C:\Users\real-user\..., D:\Projects\..., /Users/real-user/..., /home/real-user/..., /mnt/data/..., /workspace/..., /var/secrets/..., /opt/internal/..., or ~/private/....
Allowed placeholder path patterns include /path/to/..., /example/..., obvious values containing OWNER_NAME, PROJECT_ID, example, demo, or placeholder, and /tmp/... for tooling convenience.
Run:
python scripts/package_skill.py --output dist/agent-memory-blueprint.zipThe package check must reject caches, .git, .env, private memory files, private/, backups/, .pyc, and nested dist/ output.
read_profiles choose execution, history, or update-memory mode.project_skill_cards short enough for every execution.supersedes or deprecation notes for correction instead of silent deletion.passed, partial, blocked, or not_run.--strict-public.python scripts/release_check.py or make release-check.dist/agent-memory-blueprint.zip.strict-public to make unsafe content pass.assets/memory-template.yaml: public starter templateexamples/: synthetic public examples for productivity, software, and research workflowsschemas/memory.schema.json: baseline JSON Schema for core structurescripts/analyze_memory_shape.py: private-safe structural analyzerscripts/package_skill.py: public-safe zip packagerscripts/release_check.py: one-command release verificationscripts/scaffold_memory.py: deterministic template generatorscripts/validate_memory.py: structural and strict-public validatortests/: regression tests for validators, examples, and private-safe analysisreferences/architecture.md: architecture modelreferences/schema.md: field contracts and naming rulesreferences/update-protocol.md: live-memory editing procedurereferences/publication.md: GitHub/public-release boundary~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.