EdgeHDF5 Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:07 PM UTC
• Version: 1.93.0

Overview

The skill is a disclosed agent-memory tool, but it encourages long-term saving and later export of conversation content without clear consent, minimization, or retention controls.

Review this carefully before installing. Use it only for conversations you are comfortable storing long term, keep the HDF5 and WAL files in a protected location, avoid saving secrets or regulated personal data, and prefer a pinned reviewed version of the edgehdf5 CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:8

Finding

Unpinned Third-Party Cargo Package Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh, lines 8-9
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

echo "Installing edgehdf5-cli from crates.io..."
cargo install edgehdf5-cli

Technical Analysis

The setup script installs edgehdf5-cli from crates.io without specifying an exact version, requiring locked dependency resolution, verifying a checksum, or pinning a reviewed source revision. Consequently, the installed package and its transitive dependencies may change after this Skill has been audited.

cargo install downloads and compiles package-controlled source code. Cargo build scripts and procedural macros may execute code during compilation with the privileges of the user running the setup script. A compromise of the named crate, its maintainer account, or a transitive dependency could therefore turn a routine installation into arbitrary local code execution.

The preceding command -v edgehdf5 check does not mitigate this supply-chain risk when the executable is absent. When it is present, the script also trusts the first matching executable on PATH without validating its provenance or integrity.

Attack Path

1. An attacker compromises the edgehdf5-cli publication channel, a maintainer account, or an install-time transitive dependency.
2. The attacker publishes a malicious release or dependency update under the expected package name.
3. A user or agent invokes scripts/setup.sh on a system where edgehdf5 is not already available on PATH.
4. cargo install edgehdf5-cli resolves the current mutable package release and dependency graph.
5. Cargo downloads and compiles the compromised source, executing any malicious build-time logic.
6. The compromised executable is installed and may later process conversation-memory files and commands.

Impact Assessment

Exploitation can execute code with the p ...[truncated 474 chars]

Remediation

View remediation

Remediation Suggestions

• Pin a reviewed exact release and require locked dependency resolution:

  bash

  readonly EDGEHDF5_VERSION="X.Y.Z"
  cargo install edgehdf5-cli \
    --version "=${EDGEHDF5_VERSION}" \
    --locked
  

• Review the selected release and its transitive dependency graph before updating the pinned version.

• Verify the package publisher, source repository, release provenance, and expected integrity data through a trusted release process.

• For stronger reproducibility, vendor reviewed dependencies or install from a trusted repository commit pinned by its full cryptographic hash.

• Run installation as an unprivileged, dedicated account in a constrained build environment without access to production credentials or sensitive memory files.

• Validate an existing edgehdf5 executable's canonical path, version, and provenance rather than trusting any executable found through PATH.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to persist, search, export, and summarize conversation memory, but it provides no warnings or safeguards around storing sensitive user content, retention, consent, or access control. In an agent-memory context, this omission is dangerous because users may unknowingly have personal, confidential, or regulated data stored long-term and later exposed through export or AGENTS.md generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow directs agents to save conversation chunks after each exchange as a default operating pattern, with no gating for consent, minimization, or sensitivity review. This increases the likelihood of indiscriminate retention of entire conversations, including secrets or private data, which can then be retrieved, exported, or propagated into summaries.

Content

No source excerpt is available for this finding.