EdgeHDF5 Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:07 PM UTC
• Version: 1.93.0

Overview

The skill is a disclosed agent-memory tool, but it encourages long-term saving and later export of conversation content without clear consent, minimization, or retention controls.

Review this carefully before installing. Use it only for conversations you are comfortable storing long term, keep the HDF5 and WAL files in a protected location, avoid saving secrets or regulated personal data, and prefer a pinned reviewed version of the edgehdf5 CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:8
• Finding: Unpinned Third-Party Cargo Package Installation## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 8-9 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash echo "Installing edgehdf5-cli from crates.io..." cargo install edgehdf5-cli ``` ### Technical Analysis The setup script installs `edgehdf5-cli` from crates.io without specifying an exact version, requiring locked dependency resolution, verifying a checksum, or pinning a reviewed source revision. Consequently, the installed package and its transitive dependencies may change after this Skill has been audited. `cargo install` downloads and compiles package-controlled source code. Cargo build scripts and procedural macros may execute code during compilation with the privileges of the user running the setup script. A compromise of the named crate, its maintainer account, or a transitive dependency could therefore turn a routine installation into arbitrary local code execution. The preceding `command -v edgehdf5` check does not mitigate this supply-chain risk when the executable is absent. When it is present, the script also trusts the first matching executable on `PATH` without validating its provenance or integrity. ### Attack Path 1. An attacker compromises the `edgehdf5-cli` publication channel, a maintainer account, or an install-time transitive dependency. 2. The attacker publishes a malicious release or dependency update under the expected package name. 3. A user or agent invokes `scripts/setup.sh` on a system where `edgehdf5` is not already available on `PATH`. 4. `cargo install edgehdf5-cli` resolves the current mutable package release and dependency graph. 5. Cargo downloads and compiles the compromised source, executing any malicious build-time logic. 6. The compromised executable is installed and may later process conversation-memory files and commands. ### Impact Assessment Exploitation can execute code with the p ...[truncated 474 chars]
• Remediation: ## Remediation Suggestions - Pin a reviewed exact release and require locked dependency resolution: ```bash readonly EDGEHDF5_VERSION="X.Y.Z" cargo install edgehdf5-cli \ --version "=${EDGEHDF5_VERSION}" \ --locked ``` - Review the selected release and its transitive dependency graph before updating the pinned version. - Verify the package publisher, source repository, release provenance, and expected integrity data through a trusted release process. - For stronger reproducibility, vendor reviewed dependencies or install from a trusted repository commit pinned by its full cryptographic hash. - Run installation as an unprivileged, dedicated account in a constrained build environment without access to production credentials or sensitive memory files. - Validate an existing `edgehdf5` executable's canonical path, version, and provenance rather than trusting any executable found through `PATH`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to persist, search, export, and summarize conversation memory, but it provides no warnings or safeguards around storing sensitive user content, retention, consent, or access control. In an agent-memory context, this omission is dangerous because users may unknowingly have personal, confidential, or regulated data stored long-term and later exposed through export or AGENTS.md generation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The workflow directs agents to save conversation chunks after each exchange as a default operating pattern, with no gating for consent, minimization, or sensitivity review. This increases the likelihood of indiscriminate retention of entire conversations, including secrets or private data, which can then be retrieved, exported, or propagated into summaries.