chroma-hybrid-search
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads embedding and reranking models (
multilingual-e5-smallandbge-reranker-base) from Hugging Face's official repositories using thehuggingface_hublibrary. This is a well-known service and the operation is standard for initializing local semantic search capabilities. - [COMMAND_EXECUTION]: Orchestrates the execution of local Python scripts within a managed virtual environment (
~/.deep-memory/.venv). These scripts handle indexing of local markdown files and JSONL notes, and provide a search CLI for the agent. All operations are scoped to the user's workspace storage. - [INDIRECT_PROMPT_INJECTION]: As a retrieval-augmented generation (RAG) tool, the skill ingests content from local files (
knowledge-base/,experience/, andcold-notes/) to provide context. It lacks explicit filtering for instructions embedded in these source files, which is a standard characteristic of search tools rather than a malicious defect.
Audit Metadata