Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bumblebiber/hmem/hmem-updatenpx skills add Bumblebiber/hmem --skill hmem-updategit clone --depth 1 https://github.com/Bumblebiber/hmemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bumblebiber/hmem/hmem-update)<a href="https://agentmods.dev/skills/bumblebiber/hmem/hmem-update"><img src="https://agentmods.dev/badge/skills/bumblebiber/hmem/hmem-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00082 | $0.11599 |
| Opus 5 | $0.00041 | $0.05799 |
| Sonnet 5 | $0.00016 | $0.02320 |
| Haiku 4.5 | $0.00008 | $0.01160 |
Grade C, and why
hmem-update scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- **Server:** sudo access, package manager quirks, which user Claude runs as Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat ~/.claude/settings.json | grep -A5 hooks Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
ls ~/.claude/skills/hmem-*/SKILL.md # Claude Code How it starts
The opening of the file, as written. The whole thing — 1,069 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/hmem-update — Update Routine
Drives the full update flow for hmem and hmem-sync: detects the current
version, runs npm update -g if outdated, syncs skill files, applies any
migrations, verifies hooks and configs, runs the smoke test. Every step is
important — do not skip steps.
Package naming note: The npm package is
hmem(formerlyits-over-9k, before thathmem-mcp). The installed CLI is stillhmem, the MCP server tools still use thehmemprefix, and the GitHub repo isBumblebiber/hmem. Theits-over-9kname now belongs to a separate project (the o9k efficiency meta-framework) — do not npm-update via that name anymore. Always use the current package name (hmem) for npm commands.Version mapping: The renames reset the version line twice:
hmem-mcp(legacy)its-over-9k(1.x line)hmem(current)up to 7.4.x 1.0.0 – 1.3.8 8.0.0+ Steps 2d–2l below describe migrations only relevant when upgrading from the legacy 5.x/6.x/7.x line. Skip them if your installed version is 1.x or 8.x — they are already baked into the rename baseline.
Upgrading from
its-over-9k1.x: uninstall the old package and install the new name —npm update -g its-over-9kwill never reach 8.0:npm uninstall -g its-over-9k npm install -g hmem npx hmem update-skills # also removes the old o9k-* skill foldersThe skills were renamed
o9k-*→hmem-*in 8.0.0.update-skillscleans up staleo9k-*folders automatically.
Step 1: Version Check
Determine the current and latest version:
hmem --version # current installed version (e.g. "hmem 1.2.1")
npm view hmem version # latest on npm
npm view hmem versions --json # all versions (for changelog range)
Read the changelog for the version range:
cd ~/projects/hmem && git log --oneline <old-tag>..HEAD # if local repo exists
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 1,069 lines · 82 tokens per session scan C 9eff6deb3f3d
hmem-update is a skill published in the GitHub repository Bumblebiber/hmem (23 stars, last pushed 1mo ago), licensed MIT. It adds 82 tokens to every session and 11,599 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 3 findings (asks for root, reads agent configuration directories, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
kayba-ace
This skill ships learnfromtraces.py, a script that reads OpenClaw session transcripts, feeds them through the ACE learning pipeline, and writes an updated skillbook to disk.
rekal-init
Bootstrap rekal memory for a project. Scans the codebase for architecture, conventions, dependencies, workflows, and config, then stores durable knowledge as properly typed, tagged, deduplicated memories. Use when starting rekal on a new project, or when user says "init rekal", "bootstrap memory", "populate rekal"…
rekal-save
End-of-session memory capture with deduplication. Extracts durable knowledge, checks for duplicates, stores or replaces as appropriate. Use whenever a session wraps up, a task finishes, or the user says goodbye/thanks/done. Also use when significant preferences, decisions, or discoveries emerge mid-session. Make sure…
rekal-usage
Operational guide for rekal memory tools. Precise rules for when/how to call each tool, with exact parameters and decision trees. Use at session start, when onboarding to a rekal workspace, or when user asks "how do I use rekal", "what rekal tools", "help with memory". Trigger: /rekal-usage.
rekal-hygiene
Periodic memory maintenance and cleanup. Finds duplicates, contradictions, and quality issues in the memory database. Proposes fixes for user approval. Never auto-deletes or auto-modifies. Use when user says "clean up memories", "memory maintenance", "check memory health", or invokes /rekal-hygiene. Run monthly or…
vault-for-llm
Connect OpenClaw to Vault Agent Memory as a local-first governed project memory layer. Search first, then bounded-read cited source ranges; propose new memories as candidates instead of writing directly into active memory.