Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bumblebiber/hmem/hmem-sync-setupnpx skills add Bumblebiber/hmem --skill hmem-sync-setupgit clone --depth 1 https://github.com/Bumblebiber/hmemWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00055 | $0.01947 |
| Opus 5 | $0.00028 | $0.00974 |
| Sonnet 5 | $0.00011 | $0.00389 |
| Haiku 4.5 | $0.00006 | $0.00195 |
Grade D, and why
hmem-sync-setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
### Step 2: Gather credentials from the original device Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
.hmem-sync-token — auth token (chmod 600, never commit) Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
# Or via curl: How it starts
The opening of the file, as written. The whole thing — 249 lines — stays where its author put it; the contents beside it link to each section on GitHub.
hmem-sync Setup
Zero-knowledge encrypted sync for hmem. Memories are encrypted client-side (AES-256-GCM) before leaving the device — the server only sees opaque blobs.
Recommended: Use hmem-sync connect
The connect command replaces setup and restore with a single smart wizard:
npx hmem-sync connect
It automatically:
- Asks for credentials (new account or existing)
- Detects local DB + server data
- Shows entry counts on both sides
- Asks the user what to sync (push, pull, merge, or skip)
- Verifies the result
Custom / Self-hosted servers: The --server-url flag accepts any hmem-sync compatible
server, not just the default. Examples: https://yourdomain.com/hmem-sync for a self-hosted
instance, or http://localhost:3100 for a local development server.
For non-interactive use:
# New account
npx hmem-sync connect --user-id myname --passphrase "pass" --hmem-path ~/.hmem/memory.hmem
# Existing account
npx hmem-sync connect --user-id myname --passphrase "pass" --token abc123... --hmem-path ~/.hmem/memory.hmem
# Custom server
npx hmem-sync connect --server-url http://localhost:3100 --user-id myname --passphrase "pass" --hmem-path ~/.hmem/memory.hmem
The legacy setup and restore commands still work for backwards compatibility.
Legacy: Determine the scenario
If not using connect, pick manually:
A) First device — no sync account exists yet → hmem-sync setup
B) Additional device — account exists on another machine → hmem-sync restore
Scenario A: First Device Setup
Step 1: Install hmem-sync
npm install -g hmem-sync
Step 2: Run interactive setup
npx hmem-sync setup
This will:
- Ask for the sync server URL (default:
https://sync.hmem.dev) - Generate a salt + encryption key from a passphrase you choose
- Register with the server → receive an auth token
- Save config files next to your .hmem file
Important: Remember the passphrase — it's the encryption key. Losing it means losing access to synced data. There is no recovery.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 249 lines · 55 tokens per session scan D 3ce6e072df2b
hmem-sync-setup is a skill published in the GitHub repository Bumblebiber/hmem (24 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 1,947 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (harvests environment variables, asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
b123d-modeling
Use this skill when asked to model, build, or modify a 3D part or assembly with build123d — from a text description, a technical drawing (image or PDF), dimensions in a spec, or an existing STEP/STL file.
authoring-decorators
Use when the user wants to write a new prompt decorator - either a personal one for their repo or a contribution back to the upstream catalogue. Walks through the JSON schema, the extensions/ convention, how to verify a new decorator end-to-end through the hook, and how to diagnose failures using debug logging and…
b123d-drawing
../../../src/build123dmcp/skills/b123d-drawing/SKILL.md.
mlflow-traces
Use when working with MLflow traces: debugging via MCP tools, analyzing performance, logging feedback, writing custom scorers/evaluations, or cleaning up trace data.
gemini-visualize
Generates interactive HTML visualizations (concept maps, evidence networks, knowledge graphs) from Gemini analysis results. Triggers automatically after /gr:video, /gr:research, /gr:analyze.
tts-production
Produces voiceover audio via ElevenLabs TTS API. Activates for TTS generation, voice tuning, audio ducking, or multilingual narration — not for voice AI agents, transcription, or music.