T09 · Insecure Skill Coding Practices
Error
- Location
extension/index.ts:183- Finding
Automatic Upload of Complete Conversations to an External Honcho Service
- Content
View full analysis
{ if (!event.success || !event.messages?.length) return; const sessionKey = buildSessionKey(ctx); try { await ensureInitialized(); const session = await honcho.session(sessionKey, { metadata: {} }); let meta = await session.getMetadata(); if (meta.lastSavedIndex === undefined) { const startIndex = Math.max(0, event.messages.length - 2); await session.setMetadata({ lastSavedIndex: startIndex }); meta = { lastSavedIndex: startIndex }; } const lastSaved = meta.lastSavedIndex ?? 0; await session.addPeers([ [OWNER_ID, { observe_me: true, observe_others: false }], [OPENCLAW_ID, { observe_me: false, observe_others: true }], ]); if (event.messages.length <= lastSaved) return; const newMessages = extractMessages( event.messages.slice(lastSaved), ownerPeer, openclawPeer ); if (newMessages.length > 0) { await session.addMessages(newMessages); } await session.setMetadata({ ...meta, lastSavedIndex: event.messages.length }); } catch (err) { api.logger.error(`[mux] Failed to save to Honcho: ${err}`); } }); ``` The network destination defaults to a managed external service: ```typescript baseUrl: (pluginConfig.baseUrl as string) || "https://api.honcho.dev", ``` ### Technical Analysis The `agent_end` hook automatically extracts all newly observed user and assistant text from every successful conversation and tr ...[truncated 2317 chars]- Remediation
View remediation