Long Term Memory with Honcho

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.0.4

Overview

This skill is transparent about sending memory files and ongoing workspace conversations to Honcho, but it asks users to install an unpinned third-party plugin that will persistently handle sensitive context across sessions.

Install only if you are comfortable with a third-party Honcho plugin receiving workspace memory files and ongoing conversation data. Prefer a reviewed, pinned plugin version, verify the package/source before enabling it, use a self-hosted endpoint if appropriate, and disable the plugin when you no longer want conversation sync.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Installation of a Privileged Third-Party Plugin

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–76
Vulnerability Type: Unpinned third-party plugin and dependency installation
Risk Level: Medium

Vulnerable Code

bash

openclaw plugins install @honcho-ai/openclaw-honcho

bash

openclaw plugins enable openclaw-honcho

bash

cd ~/.openclaw/extensions/openclaw-honcho && npm install

Technical Analysis

The skill directs users to install and enable a third-party npm-based plugin without pinning a reviewed version, requiring package-integrity verification, or enforcing a lockfile. The fallback command also runs an unrestricted npm install, allowing npm to resolve the dependency graph available at installation time.

Consequently, the code ultimately executed can differ from the version that existed when the skill was audited. This risk is significant because the plugin is intentionally granted access to workspace memory and agent-configuration files, stores an API key in ~/.openclaw/openclaw.json, observes conversations, communicates with a network endpoint, and remains enabled across sessions.

The documented behavior does not itself establish malicious intent. The vulnerability is the absence of controls protecting this privileged installation process from a compromised package release or transitive dependency.

Attack Path

1. An attacker compromises @honcho-ai/openclaw-honcho, its publishing account, or one of its transitive dependencies.
2. The attacker publishes a malicious version or modifies a dependency selected by npm resolution.
3. A user follows the skill and installs the package without a version or integrity constraint.
4. The user enables the plugin, or runs the fallback npm install, causing the compromised code to become part of the OpenClaw extension.
5. The compromised plugin executes in the gateway context and can abuse the plugin's legitimate access to sensitive workspace content, configuration, conversations, credentials, and netwo ...[truncated 870 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @honcho-ai/openclaw-honcho to a specific version that has been reviewed and tested.
2. Verify package integrity using an expected cryptographic digest or equivalent package-manager integrity control before enabling the plugin.
3. Document and verify the expected npm publisher, source repository, release provenance, and signing information.
4. Replace the unrestricted fallback npm install with a reproducible installation based on a reviewed lockfile, such as npm ci with a committed and verified lockfile.
5. Audit direct and transitive dependencies and enable automated monitoring for compromised, deprecated, or vulnerable releases.
6. Review the installed extension source before enabling it, especially code that reads workspace files, accesses configuration, registers conversation hooks, or performs network requests.
7. Install and run the plugin with the minimum filesystem and process privileges required.
8. Restrict outbound traffic to an explicitly approved HTTPS endpoint and reject insecure or unexpected destination URLs.
9. Provide rollback instructions that disable and remove the plugin if package integrity or publisher trust cannot be verified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The skill explicitly enables a plugin that persistently observes workspace conversations and transmits them to an external endpoint across sessions. Even with disclosure and interactive setup, this creates a real confidentiality risk because sensitive prompts, responses, and operational context may be continuously exfiltrated outside the local environment.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

Honcho memory is now active.

> **Ongoing behavior after setup**: Once enabled, the plugin will persistently observe conversations in this workspace and send conversation data to `api.honcho.dev` (or your configured `HONCHO_BASE_URL`) to build and retrieve memory. This is ongoing network activity that continues across sessions. Memory is made available via `honcho_recall`, `honcho_search`, `honcho_profile`, and related tools. To stop this behavior, disable the plugin with `openclaw plugins disable openclaw-honcho`.

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The setup process writes configuration, including the API key, to ~/.openclaw/openclaw.json, creating persistent local storage of a credential and long-lived plugin state. If file permissions are weak, the host is shared, or users do not realize the setting persists, this can expose credentials and keep external transmission enabled beyond the initial session.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

This command will:

1. Prompt interactively for your Honcho API key
2. Write configuration to `~/.openclaw/openclaw.json`
3. Scan for legacy memory files and offer to migrate them to Honcho

Follow the prompts. Migration is optional — if you have no legacy files or want to skip, you can skip the upload step.

Static analysis

No suspicious patterns detected.