Waxell

plugin

claude-mem High risk

thedotmackthedotmack/claude-memupdated

Memory compression system for Claude Code - persist context across sessions
thedotmack's own description, from the plugin's files.
Stars
111,683
Version
v1
Copies
0

Overview

blockHigh risk

Waxell rates it high risk: 9 findings, highest severity critical.

Highest severity
critical
Findings
9
What ran
Static analysis

A clean result means nothing alarming in what is published, not a guarantee. How the checks work

Skills in this plugin

We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.

Security

Security scan

Checked 2 days ago

Result

High risk Waxell rates it high risk: 9 findings, highest severity critical.

Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work

Findings (9)

critical · 1

  • critical

    Tells Claude to download a script and pipe it to a shell

    plugin/scripts/worker-service.cjs:671 · skill_risk:S1

high · 8

  • high

    Tells Claude to install unpinned packages (never, pays, a, synchronous)

    plugin/scripts/bun-runner.js:51 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (threw)

    plugin/scripts/version-check.js:244 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (failed)

    plugin/scripts/version-check.js:265 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (exited, 0, but, dependencies, are, still …)

    plugin/scripts/version-check.js:293 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (@anthropic-ai/claude-code@latest)

    plugin/scripts/worker-service.cjs:798 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (tzdata)

    plugin/skills/agent-cost-report/scripts/acr.py:21 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (result.stderr, re.MULTILINE)

    plugin/skills/agent-cost-report/scripts/tests/test_period.py:30 · skill_risk:S2

  • high

    Tells Claude to install unpinned packages (tzdata)

    plugin/skills/agent-cost-report/scripts/tests/test_period.py:34 · skill_risk:S2

Versions

Version history

Each distinct content we have seen, newest first, with the verdict it got at the time.

One version so far: v1 (15.9.0), seen 2026-11-03.

Files

Files

198 files, 21.7 MB in total. Names only; open them on GitHub.

  • .claude-plugin/plugin.json
  • .codex-plugin/plugin.json
  • .mcp.json
  • .qoder-plugin/plugin.json
  • bun.lock
  • hooks/codex-hooks.json
  • hooks/hooks.json
  • hooks/qoder-hooks.json
  • hooks/qoder-repo-hooks.json
  • modes/code--ar.json
  • modes/code--bn.json
  • modes/code--chill.json
  • modes/code--cs.json
  • modes/code--da.json
  • modes/code--de.json
  • modes/code--el.json
  • modes/code--es.json
  • modes/code--fi.json
  • modes/code--fr.json
  • modes/code--he.json
  • modes/code--hi.json
  • modes/code--hu.json
  • modes/code--id.json
  • modes/code--it.json
  • modes/code--ja.json
  • modes/code--ko.json
  • modes/code--nl.json
  • modes/code--no.json
  • modes/code--pl.json
  • modes/code--pt-br.json
  • modes/code--ro.json
  • modes/code--ru.json
  • modes/code--sv.json
  • modes/code--th.json
  • modes/code--tr.json
  • modes/code--uk.json
  • modes/code--ur.json
  • modes/code--vi.json
  • modes/code--zh.json
  • modes/code.json
  • modes/email-investigation.json
  • modes/law-study--chill.json
  • modes/law-study-CLAUDE.md
  • modes/law-study.json
  • modes/meme-tokens.json
  • package.json
  • qoder.mcp.json
  • scripts/bun-runner.js
  • scripts/claude-mem-launcher.cjs
  • scripts/claude-mem-launcher.cjs.map
  • scripts/context-generator.cjs
  • scripts/context-generator.cjs.map
  • scripts/context-read-worker.cjs
  • scripts/context-read-worker.cjs.map
  • scripts/ensure-launcher.cjs
  • scripts/ensure-launcher.cjs.map
  • scripts/mcp-server.cjs
  • scripts/mcp-server.cjs.map
  • scripts/qoder-hook-launcher.cjs
  • scripts/server-service.cjs
  • scripts/server-service.cjs.map
  • scripts/statusline-counts.js
  • scripts/transcript-watcher.cjs
  • scripts/transcript-watcher.cjs.map
  • scripts/version-check.js
  • scripts/work-view-read-worker.cjs
  • scripts/work-view-read-worker.cjs.map
  • scripts/worker-service.cjs
  • scripts/worker-service.cjs.map
  • scripts/worker-wrapper.cjs
  • skills/agent-cost-report/.gitignore
  • skills/agent-cost-report/CHECKSUMS.txt
  • skills/agent-cost-report/SKILL.md
  • skills/agent-cost-report/VERIFICATION.md
  • skills/agent-cost-report/scripts/acr.py
  • skills/agent-cost-report/scripts/acr/__init__.py
  • skills/agent-cost-report/scripts/acr/behavior.py
  • skills/agent-cost-report/scripts/acr/classify.py
  • skills/agent-cost-report/scripts/acr/costs.py
  • skills/agent-cost-report/scripts/acr/devices.py
  • skills/agent-cost-report/scripts/acr/evidence.py
  • skills/agent-cost-report/scripts/acr/labels.py
  • skills/agent-cost-report/scripts/acr/measure.py
  • skills/agent-cost-report/scripts/acr/mistakes.py
  • skills/agent-cost-report/scripts/acr/patterns.py
  • skills/agent-cost-report/scripts/acr/period.py
  • skills/agent-cost-report/scripts/acr/prices.py
  • skills/agent-cost-report/scripts/acr/render.py
  • skills/agent-cost-report/scripts/acr/rollup.py
  • skills/agent-cost-report/scripts/acr/rules.json
  • skills/agent-cost-report/scripts/acr/rules.py
  • skills/agent-cost-report/scripts/acr/sample.py
  • skills/agent-cost-report/scripts/acr/snapshot.py
  • skills/agent-cost-report/scripts/acr/sync.py
  • skills/agent-cost-report/scripts/acr/transcripts.py
  • skills/agent-cost-report/scripts/acr/wins.py
  • skills/agent-cost-report/scripts/tests/_db.py
  • skills/agent-cost-report/scripts/tests/_paths.py
  • skills/agent-cost-report/scripts/tests/fixtures/codex/sessions/2026/09/18/rollout-codex-1.jsonl
  • skills/agent-cost-report/scripts/tests/fixtures/make_report_fixtures.py
  • skills/agent-cost-report/scripts/tests/fixtures/prices_sample.json
  • skills/agent-cost-report/scripts/tests/fixtures/projects/-workspace-proj-a/sess-aaaa.jsonl
  • skills/agent-cost-report/scripts/tests/fixtures/projects/-workspace-proj-b/sess-bbbb.jsonl
  • skills/agent-cost-report/scripts/tests/fixtures/report-1day.json
  • skills/agent-cost-report/scripts/tests/fixtures/report-30day.json
  • skills/agent-cost-report/scripts/tests/fixtures/report-7day.json
  • skills/agent-cost-report/scripts/tests/fixtures/report-empty.json
  • skills/agent-cost-report/scripts/tests/fixtures/report-session.json
  • skills/agent-cost-report/scripts/tests/test_behavior.py
  • skills/agent-cost-report/scripts/tests/test_devices.py
  • skills/agent-cost-report/scripts/tests/test_labels.py
  • skills/agent-cost-report/scripts/tests/test_measure.py
  • skills/agent-cost-report/scripts/tests/test_pdf_windows.py
  • skills/agent-cost-report/scripts/tests/test_period.py
  • skills/agent-cost-report/scripts/tests/test_prices.py
  • skills/agent-cost-report/scripts/tests/test_render.py
  • skills/agent-cost-report/scripts/tests/test_render_encoding.py
  • skills/agent-cost-report/scripts/tests/test_rollup.py
  • skills/agent-cost-report/scripts/tests/test_snapshot.py
  • skills/agent-cost-report/scripts/tests/test_sync.py
  • skills/agent-cost-report/scripts/tests/test_transcript_encoding.py
  • skills/agent-cost-report/scripts/tests/test_transcripts.py
  • skills/agent-cost-report/scripts/tests/test_wins.py
  • skills/agent-cost-report/verification/precision-2026-09-26.json
  • skills/babysit/SKILL.md
  • skills/backup-setup/SKILL.md
  • skills/build-and-release/SKILL.md
  • skills/ccs-align/SKILL.md
  • skills/childhood/SKILL.md
  • skills/cloud-sync/SKILL.md
  • skills/design-is/SKILL.md
  • skills/do/SKILL.md
  • skills/handoff/SKILL.md
  • skills/how-it-works/SKILL.md
  • skills/how-it-works/onboarding-explainer.md
  • skills/knowledge-agent/SKILL.md
  • skills/learn-codebase/SKILL.md
  • skills/make-plan/SKILL.md
  • skills/mem-search/SKILL.md
  • skills/mode-creator/SKILL.md
  • skills/mode-creator/evals/evals.json
  • skills/mode-creator/references/mode-authoring.md
  • skills/mode-creator/references/telegram.md
  • skills/mode-creator/scripts/configure-telegram.mjs
  • skills/mode-creator/scripts/install-mode.mjs
  • skills/oh-my-issues/SKILL.md
  • skills/owner-goals/SKILL.md
  • skills/owner-goals/scripts/export_owner_prompts.py
  • skills/owner-goals/scripts/save_goals.py
  • skills/pathfinder/SKILL.md
  • skills/release/SKILL.md
  • skills/request-progress/SKILL.md
  • skills/request-progress/scripts/request-groups.mjs
  • skills/screenpipe/SKILL.md
  • skills/screenpipe/screenpipe.mjs
  • skills/smart-explore/SKILL.md
  • skills/standup/SKILL.md
  • skills/standup/agent-brief.md
  • skills/standup/standup.mjs
  • skills/timeline-report/SKILL.md
  • skills/version-bump/SKILL.md
  • skills/version-bump/scripts/generate_changelog.js
  • skills/weekly-digests/SKILL.md
  • skills/what-the/SKILL.md
  • skills/wowerpoint/SKILL.md
  • sqlite/SessionStore.js
  • sqlite/SessionStore.js.map
  • sqlite/observations/files.js
  • sqlite/observations/files.js.map
  • ui/assets/fonts/monaspace-radon-var.woff
  • ui/assets/fonts/monaspace-radon-var.woff2
  • ui/claude-mem-logo-for-dark-mode.webp
  • ui/claude-mem-logo-stylized.png
  • ui/claude-mem-logomark.webp
  • ui/icon-thick-completed.svg
  • ui/icon-thick-investigated.svg
  • ui/icon-thick-learned.svg
  • ui/icon-thick-next-steps.svg
  • ui/icon-thick-notes.svg
  • ui/tv.html
  • ui/viewer-bundle.js
  • ui/viewer.html
  • ui/work-view/assets/HankenGrotesk-wght-2z-3qhAN.ttf
  • ui/work-view/assets/at-home-modern-computer-JH_MTm9z.webp
  • ui/work-view/assets/claude-DqipVtpa.webp
  • ui/work-view/assets/geist-cyrillic-ext-wght-normal-DjL33-gN.woff2
  • ui/work-view/assets/geist-cyrillic-wght-normal-BEAKL7Jp.woff2
  • ui/work-view/assets/geist-latin-ext-wght-normal-DC-KSUi6.woff2
  • ui/work-view/assets/geist-latin-wght-normal-BgDaEnEv.woff2
  • ui/work-view/assets/geist-vietnamese-wght-normal-6IgcOCM7.woff2
  • ui/work-view/assets/index-1YS6gs-U.css
  • ui/work-view/assets/index-CjrRzEm_.js
  • ui/work-view/assets/on-the-go-iphone-feed-BOm9aG2q.webp
  • ui/work-view/assets/setup-page-BcFoY6f1.css
  • ui/work-view/assets/setup-page-ZRrfFNL3.js
  • ui/work-view/assets/setup-sample-D1iBnNk9.js
  • ui/work-view/favicon.svg
  • ui/work-view/index.html

See and control which skills your people use

Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

More documents skills and plugins

See all