Security audit

Long-Term Memory (Honcho)

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about installing Honcho, but it enables ongoing upload of workspace conversations to an external memory service and stores an API key locally, so it needs user review before use.

Install only if you are comfortable with workspace memory files and all future workspace conversations being sent to Honcho or your configured endpoint until the plugin is disabled. Prefer a trusted HTTPS endpoint, review or pin the plugin package where possible, avoid entering secrets in monitored conversations, and be prepared to rotate or revoke the Honcho API key if ~/.openclaw/openclaw.json is exposed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:64
Finding: Unpinned Third-Party Plugin and Dependency Installation
Content: View full analysis
Remediation: View remediation
``` 2. Verify the package against a documented cryptographic digest or trusted package signature before enabling it. 3. Publish and audit a dependency lockfile for the plugin. 4. Replace unrestricted `npm install` with a deterministic command such as `npm ci` against the reviewed lockfile. 5. Disable or carefully review npm lifecycle scripts during installation where operationally possible. 6. Validate package provenance and publisher identity through the registry's supported provenance mechanism. 7. Review the installed plugin source before enabling it, particularly its conversation hooks, file access, credential handling, and network destinations. 8. Run the plugin under a least-privileged account or sandbox with access limited to the files and network endpoints necessary for its stated function. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:147
Finding: Persistent Transmission of All Workspace Conversations to an External Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:136
Finding: Honcho API Key Stored in a General JSON Configuration File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context Leakage

High

Category: Data Exfiltration
Confidence: 98% confidence
Finding: The skill explicitly installs and enables a plugin that persistently observes workspace conversations and transmits that data to an external service across sessions. Even though the behavior is disclosed and initially consent-gated, it creates a real confidentiality risk because future conversation content may include sensitive prompts, credentials, proprietary code, or personal data that leave the local environment continuously.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
Honcho memory is now active. > **Ongoing behavior after setup**: Once enabled, the plugin will persistently observe conversations in this workspace and send conversation data to `api.honcho.dev` (or your configured `HONCHO_BASE_URL`) to build and retrieve memory. This is ongoing network activity that continues across sessions. Memory is made available via `honcho_recall`, `honcho_search`, `honcho_profile`, and related tools. To stop this behavior, disable the plugin with `openclaw plugins disable openclaw-honcho`. ---

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: The setup flow writes plugin configuration, including the API key per the skill text, to ~/.openclaw/openclaw.json, creating session-persistent state and storing a secret on disk. This is a legitimate security concern because long-lived local storage of credentials and persistent enablement increase the blast radius if the host or config file is later accessed by another process, user, or compromised plugin.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
This command will: 1. Prompt interactively for your Honcho API key 2. Write configuration to `~/.openclaw/openclaw.json` 3. Scan for legacy memory files and offer to migrate them to Honcho Follow the prompts. Migration is optional — if you have no legacy files or want to skip, you can skip the upload step.

Static analysis

No suspicious patterns detected.