Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Bumblebiber/hmem --skill hmem-sync-setupgit clone --depth 1 https://github.com/Bumblebiber/hmemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bumblebiber/hmem/hmem-sync-setup)<a href="https://agentmods.dev/skills/bumblebiber/hmem/hmem-sync-setup"><img src="https://agentmods.dev/badge/skills/bumblebiber/hmem/hmem-sync-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bumblebiber/hmem/hmem-sync-setup"><img src="https://agentmods.dev/badge/skills/bumblebiber/hmem/hmem-sync-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.01947 |
| Opus 5.5 | $0.00022 | $0.00779 |
| Sonnet 5.5 | $0.00011 | $0.00389 |
| Haiku 4.5 | $0.00006 | $0.00195 |
Grade D, and why
hmem-sync-setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
### Step 2: Gather credentials from the original device Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
.hmem-sync-token — auth token (chmod 600, never commit) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# Or via curl: How it starts
The opening of the file, as written. The whole thing — 249 lines — stays where its author put it; the contents beside it link to each section on GitHub.
hmem-sync Setup
Zero-knowledge encrypted sync for hmem. Memories are encrypted client-side (AES-256-GCM) before leaving the device — the server only sees opaque blobs.
Recommended: Use hmem-sync connect
The connect command replaces setup and restore with a single smart wizard:
npx hmem-sync connect
It automatically:
- Asks for credentials (new account or existing)
- Detects local DB + server data
- Shows entry counts on both sides
- Asks the user what to sync (push, pull, merge, or skip)
- Verifies the result
Custom / Self-hosted servers: The --server-url flag accepts any hmem-sync compatible
server, not just the default. Examples: https://yourdomain.com/hmem-sync for a self-hosted
instance, or http://localhost:3100 for a local development server.
For non-interactive use:
# New account
npx hmem-sync connect --user-id myname --passphrase "pass" --hmem-path ~/.hmem/memory.hmem
# Existing account
npx hmem-sync connect --user-id myname --passphrase "pass" --token abc123... --hmem-path ~/.hmem/memory.hmem
# Custom server
npx hmem-sync connect --server-url http://localhost:3100 --user-id myname --passphrase "pass" --hmem-path ~/.hmem/memory.hmem
The legacy setup and restore commands still work for backwards compatibility.
Legacy: Determine the scenario
If not using connect, pick manually:
A) First device — no sync account exists yet → hmem-sync setup
B) Additional device — account exists on another machine → hmem-sync restore
Scenario A: First Device Setup
Step 1: Install hmem-sync
npm install -g hmem-sync
Step 2: Run interactive setup
npx hmem-sync setup
This will:
- Ask for the sync server URL (default:
https://sync.hmem.dev) - Generate a salt + encryption key from a passphrase you choose
- Register with the server → receive an auth token
- Save config files next to your .hmem file
Important: Remember the passphrase — it's the encryption key. Losing it means losing access to synced data. There is no recovery.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 249 lines · 55 tokens per session scan D 3ce6e072df2b
hmem-sync-setup is a skill published in the GitHub repository Bumblebiber/hmem (24 stars, last pushed 2mo ago), licensed MIT. It adds 55 tokens to every session and 1,947 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it D with 3 findings (harvests environment variables, asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kayba-ace
This skill ships learnfromtraces.py, a script that reads OpenClaw session transcripts, feeds them through the ACE learning pipeline, and writes an updated skillbook to disk.
nornweave-api
Give AI agents their own email inboxes using the NornWeave API. Use when building email agents, sending/receiving emails programmatically, managing inboxes, retrieving threads, searching messages, or integrating with email providers (Mailgun, SES, SendGrid, Resend). NornWeave provides LLM-ready markdown parsing and…
faf-expert
Expert in .faf (Foundational AI-context Format) files for persistent project context. Use when working with .faf files, project DNA, CLAUDE.md bi-sync, faf-cli commands, MCP server configuration, or AI-readiness scoring (0-100%). Updated for v2.8.0 Tool Visibility System.
rekal-init
Bootstrap rekal memory for a project. Scans the codebase for architecture, conventions, dependencies, workflows, and config, then stores durable knowledge as properly typed, tagged, deduplicated memories. Use when starting rekal on a new project, or when user says "init rekal", "bootstrap memory", "populate rekal"…
rekal-save
End-of-session memory capture with deduplication. Extracts durable knowledge, checks for duplicates, stores or replaces as appropriate. Use whenever a session wraps up, a task finishes, or the user says goodbye/thanks/done. Also use when significant preferences, decisions, or discoveries emerge mid-session. Make sure…
rekal-hygiene
Periodic memory maintenance and cleanup. Finds duplicates, contradictions, and quality issues in the memory database. Proposes fixes for user approval. Never auto-deletes or auto-modifies. Use when user says "clean up memories", "memory maintenance", "check memory health", or invokes /rekal-hygiene. Run monthly or…