Honcho Memory Multiplexer

• Analyzed: May 11, 2026, 4:51 AM
• Findings: 1
• Version: 0.1.0
• Hash: 7e3016d25e3f5e333a6a8d16781592f887dc15e458c6e512d06e71f983c7625e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to integrate OpenClaw agents with the Honcho memory system, offering both cloud storage and local file fallback. The `SKILL.md` clearly outlines the installation, memory migration, and agent instruction updates, including explicit guardrails against data loss and unauthorized actions. The `extension/index.ts` (and compiled `index.js`) implements this logic, notably including a robust path traversal prevention mechanism in the `memory_get` tool, limiting file access to `MEMORY.md` and the `memory/` directory. While `SKILL.md` mentions `git clone` and `docker compose up -d`, these are part of an *optional* self-hosting setup for Honcho, not arbitrary agent commands, and are accompanied by instructions for user confirmation. The plugin's network access to `HONCHO_BASE_URL` is declared and essential for its function. There is no evidence of intentional harmful behavior, data exfiltration beyond the stated purpose, or malicious prompt injection attempts.