Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JKHeadley/instar --skill agent-memorygit clone --depth 1 https://github.com/JKHeadley/instarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jkheadley/instar/agent-memory)<a href="https://agentmods.dev/skills/jkheadley/instar/agent-memory"><img src="https://agentmods.dev/badge/skills/jkheadley/instar/agent-memory/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jkheadley/instar/agent-memory"><img src="https://agentmods.dev/badge/skills/jkheadley/instar/agent-memory.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Agent Snooping · line 159 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- high Agent Snooping · line 172 Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
- medium MCP Rug Pull · line 258 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01878 |
| Opus 5.5 | $0.00000 | $0.00751 |
| Sonnet 5.5 | $0.00000 | $0.00376 |
| Haiku 4.5 | $0.00000 | $0.00188 |
Grade B, and why
agent-memory scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat >> .claude/MEMORY.md << 'EOF' How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
agent-memory — Cross-Session Memory Patterns for Claude Code
Claude Code has no memory between sessions by default. Every conversation starts blank. But a project's knowledge accumulates — commands discovered, patterns debugged, preferences revealed, mistakes made and corrected. Without persistence, that knowledge is lost every time the window closes.
This skill establishes a simple, durable memory pattern using a single file: MEMORY.md.
The Core Pattern
One file. Written by the agent. Read at session start.
.claude/
MEMORY.md # The agent's persistent knowledge base
identity/ # Optional: separate identity files (see agent-identity skill)
memory/ # Optional: topic files as memory grows
debugging.md
deployment.md
user-preferences.md
Setting Up MEMORY.md
Create .claude/MEMORY.md with this structure:
# [Project/Agent] Memory
> This file persists across sessions. Write here when you learn something
> worth remembering. Remove entries that become outdated. Keep it useful,
> not comprehensive.
## Project Patterns
[Commands, scripts, conventions specific to this project]
## Tools & Scripts
[Purpose-built scripts and how to invoke them]
## Lessons Learned
[Mistakes made and corrections. Dated entries.]
## User Preferences
[Communication style, workflow preferences, discovered through interaction]
## Open Questions
[Unresolved things to investigate — remove when resolved]
Then add this to your CLAUDE.md:
## Memory
At the start of every session, read `.claude/MEMORY.md` before doing any work.
After context compaction, re-read it immediately.
When you learn something worth keeping, write it to MEMORY.md before the session ends.
What to Write vs. What to Skip
The most common mistake: writing everything, making the file so long it stops being read carefully.
Write to MEMORY.md:
- Project-specific commands, especially non-obvious ones
- "Run
npm run build:prodnotnpm run build— the latter overwrites staging"
- "Run
- Scripts you built and their locations
- ".claude/scripts/check-email.py — reads Gmail unread, takes --limit flag"
- Mistakes made once that shouldn't happen again
- "2025-03-12: Pushed to main while on detached HEAD. Always verify branch before committing."
- User preferences discovered through interaction, not assumed
- "Prefers Telegram summaries over file links"
- Patterns that took time to figure out
- "Prisma requires explicit
includefor relations — no auto-eager-loading"
- "Prisma requires explicit
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 262 lines · 0 tokens per session scan B 35d6b194efbc
agent-memory is a skill published in the GitHub repository JKHeadley/instar (84 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,878 tokens. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wiki-ingest
Use when an operation issue asks to ingest a captured raw/ source into the LLM Wiki, or the user says "ingest ". Create durable source, entity, concept, synthesis, index, and log pages; use paperclip-distill for Paperclip bundles.
wiki-lint
Use when an LLM Wiki operation issue is a lint or health check. Audit for contradictions, orphans, weak provenance, broken links, missing concept pages, and index/log drift; return triage findings without auto-fixing.
agent-memory-coordinator
Agent skill for memory-coordinator - invoke with $agent-memory-coordinator.
agent-collective-intelligence-coordinator
Agent skill for collective-intelligence-coordinator - invoke with $agent-collective-intelligence-coordinator.
remember
Review the current conversation and capture valuable knowledge — best practices, coding conventions, architecture decisions, workflows, and user feedback — into persistent memory (AGENTS.md) or reusable skills. Use when the user says: (1) remember this, (2) save what we learned, (3) update memory, (4) capture…
coding-prefs
Read the user's coding preferences from /memory/coding-prefs.md before making non-trivial style decisions, and append new preferences when the user gives durable feedback.