Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Remember · h-mmer | DecimalAI

h-mmer/remember

SkillScore83Maintained

Log a finding or pattern to persistent brain memory. Auto-fills from session context. Usage: /remember

agent-toolingby h-mmer

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/h-mmer-remember/SKILL.md

decimalai skills pull h-mmer-remember --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/h-mmer-remember/SKILL.md https://app.decimal.ai/s/h-mmer-remember/SKILL.md

Raw file: /s/h-mmer-remember/SKILL.md ↗ · machine-readable summary at /s/h-mmer-remember.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 56d ago

Yes — +70% lift-15% tokens0% turns83% of whole cases pass with skill (19/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	62%	0%
case-04	✗→✓	▲ Improved	-18%	0%
case-05	✗→✓	▲ Improved	-11%	0%
case-06	✗→✓	▲ Improved	-50%	0%
case-07	✗→✓	▲ Improved	19%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

H-mmer / pentest-agents

.claude/skills/remember/SKILL.md

View on GitHub ↗

Imported 8/1/2026Version v2

Skill contents

SKILL.md

Save current finding/pattern to brain memory.

Flow

Read current session context — what target, endpoint, vuln class
Ask user to confirm or edit:

Target: (auto-detected)
Endpoint: (from session)
Vuln class: (from session)
Result: confirmed / rejected / partial
Severity: critical / high / medium / low
Bounty: $___
Notes: ___

Write to brain:

If confirmed: uv run python3 ../../tools/brain.py record <target> confirmed "<description>" "<details>"
If rejected: uv run python3 ../../tools/brain.py record <target> exhausted "<what failed>" "<why>"

Sync to global brain: uv run python3 ../../tools/global_brain.py learn technique "<pattern>"
Track response if submitted: uv run python3 ../../tools/response_tracker.py log <id> <status>

Why This Matters

/resume shows which endpoints you've tested and which remain
Cross-target learning: patterns from target A inform hunting on target B
Global brain accumulates technique knowledge across all engagements

Top-Tier Recall Standard

Before writing memory, make it useful to a future agent that has no conversation context.

Use this shape:

target:
surface:
vuln_class:
primitive:
accounts_or_roles:
evidence_path:
request_summary:
response_marker:
impact:
status:
next_action:

If the item is rejected, preserve the blocker with the same care as a finding. High-quality negative memory prevents duplicate work and false confidence.

Illustrative Want to see what h-mmer/remember would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/3/2026, 07:18 UTC · 23 cases

Lift

+70%

83% vs 13%

Agent turns

0%

1.0 vs 1.0

Tokens

-15%

1,413.3 vs 1,656.04

fail → pass · 16pass → pass · 3fail → fail · 4

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I just finished testing the password reset flow on acme.com and confirmed a privilege escalation vulnerability. Can you save this finding into long-term memory so future pentesting sessions remember what we tested and discovered?	fail→fail	13,772	16,177	+17%	1	1	0%	997	2,326	+133%	0	0	—
case-02 We verified that the SQL injection payload on the search API endpoint failed due to strict parameter binding. Please record this failed attempt and the blocker into our persistent security database so we don't re-test it later.	fail→pass	6,898	13,543	+96%	1	1	0%	1,042	1,683	+62%	0	0	—
case-03 I'd like to archive our SSRF finding from this session into the persistent brain memory and track the submission details. Please review the target, endpoint, and severity information with me before writing it out.	fail→fail	15,989	19,723	+23%	1	1	0%	1,406	1,696	+21%	0	0	—
case-04 We verified an IDOR on `api.example.com/user/123` allowing unauthorized profile updates. We want to record this confirmed finding into our local security brain script. What exact command line invocation should be run?	fail→pass	15,016	26,335	+75%	1	1	0%	1,632	1,332	-18%	0	0	—
case-05 Our attempt to bypass XSS filters on `app.target.org/comments` failed because CSP enforces strict nonce checking. How should this negative result be recorded via our brain memory CLI script?	fail→pass	15,325	13,594	-11%	1	1	0%	1,180	1,046	-11%	0	0	—
case-06 I need to format a structured recall memory entry for a recent privilege escalation finding on `portal.enterprise.io` so future autonomous sessions can parse the context without prior conversation history. What top-tier recall key-value structure should be used?	fail→pass	15,967	4,895	-69%	1	1	0%	2,799	1,394	-50%	0	0	—
case-07 We identified a novel SSRF technique using HTTP/2 header smuggling against an internal metadata service. In addition to local session recording, how should this technique pattern be synchronized across all engagements?	fail→pass	8,753	11,898	+36%	1	1	0%	1,308	1,552	+19%	0	0	—
case-13 We want to record a memory block for a GraphQL batching vulnerability on `api.store.com/graphql`. Provide the structured top-tier recall block matching the mandatory schema.	fail→pass	6,611	4,157	-37%	1	1	0%	1,146	1,145	-0%	0	0	—
case-08 We submitted finding report #84920 to Bugcrowd for a critical RCE on `admin.target.com`. How do we log this submission status in our local response tracker tool?	fail→pass	11,238	8,600	-23%	1	1	0%	1,938	1,256	-35%	0	0	—
case-09 During testing, our team spent 4 hours trying to achieve remote code execution via file upload on `files.acme.org`, but all uploaded scripts were stripped of executable permissions by background worker cron jobs. Should we record this rejected lead, and if so, how detailed should the negative memory entry be?	fail→pass	10,365	6,542	-37%	1	1	0%	1,925	1,364	-29%	0	0	—
case-10 Before executing any brain recording CLI scripts for a security finding, what complete list of attributes must be presented to the user for confirmation or editing?	fail→pass	14,903	4,614	-69%	1	1	0%	2,402	1,298	-46%	0	0	—
case-11 When preparing a memory record for a vulnerability finding, what specific severity values are recognized by the memory recording workflow?	pass→pass	6,953	1,310	-81%	1	1	0%	1,178	562	-52%	0	0	—
case-12 What are the allowed choices for the 'Result' status field when reviewing a finding prior to writing it to brain memory?	fail→pass	9,431	1,244	-87%	1	1	0%	1,721	544	-68%	0	0	—
case-14 We discovered an information disclosure issue on `staging.corp.com` where stack traces reveal database credentials, but we haven't confirmed full database access yet. The result status is partial. How should we proceed with confirmation and CLI commands?	fail→fail	7,973	7,211	-10%	1	1	0%	719	1,145	+59%	0	0	—
case-15 We just finished analyzing an OAuth redirect manipulation issue on `auth.client.net/callback`. Describe step 1 of the memory recording flow before asking the user for confirmation.	fail→pass	5,596	3,071	-45%	1	1	0%	963	918	-5%	0	0	—
case-16 Report #1042 was marked resolved by the triage team on HackerOne. Show the response tracking command to update this submission record.	fail→pass	8,012	2,336	-71%	1	1	0%	1,545	756	-51%	0	0	—
case-17 In our structured memory schema for zero-context future agents, what field is designated for recording the HTTP response header or body string that proves successful exploitation?	fail→pass	13,815	10,491	-24%	1	1	0%	1,378	786	-43%	0	0	—
case-22 Please generate an executive summary PDF report section for a penetration test conducted against Acme Corp, including an intro paragraph, executive summary table, and remediation recommendations.	pass→pass	12,334	19,611	+59%	1	1	0%	1,993	4,728	+137%	0	0	—
case-18 Where in the structured recall schema should the local file system path containing raw request/response PCAPs and proof-of-concept scripts be stored?	fail→pass	13,489	2,962	-78%	1	1	0%	2,295	732	-68%	0	0	—
case-19 Show the exact CLI syntax required to add the technique pattern 'OAuth state parameter omission bypass' into the shared global brain store.	fail→pass	9,482	6,622	-30%	1	1	0%	1,551	669	-57%	0	0	—
case-20 Walk through all 5 sequential operational steps when saving a confirmed bug bounty finding that was submitted for a bounty payout.	fail→pass	13,564	4,712	-65%	1	1	0%	2,271	1,265	-44%	0	0	—
case-21 We need to calculate the CVSS v3.1 base score for a SQL injection vulnerability on `db.example.com` that requires low privileges, has high impact to confidentiality and integrity, but no impact to availability. What is the vector string and CVSS score?	pass→pass	20,026	10,028	-50%	1	1	0%	4,085	2,570	-37%	0	0	—
case-23 We want to write a custom Python script using `requests` to fuzz URL paths on `https://target.com/` for hidden `.git` administrative folders. Please write the Python script.	fail→fail	41,389	12,835	-69%	1	1	0%	615	1,739	+183%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +70 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 13%
Pass rate with the skill: 82.6%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v2
Run completed: 8/3/2026, 07:18 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

We verified that the SQL injection payload on the search API endpoint failed due to strict parameter binding. Please record this failed attempt and the blocker into our persistent security database so we don't re-test it later.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run83

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+8% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.