Skill

honcho-memory

skill:plastic-labs/honcho#honcho-memory

Concepts and strategy for using a connected Honcho as persistent memory of the user — the recall/record loop and session and peer design. Start here to understand how Honcho memory works, then connect — via a first-class integration for your environment if one exists (preferred), or raw MCP tools (covered here) or the honcho-cli skill (CLI). For embedding the SDK into a codebase, use honcho-integration.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:01 UTC at bcaf722

findings

high

highest severity

threat classes

1,283

files scanned

21/21

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/honcho-memory:skills/honcho-memory/SKILL.md:12:SUPPLY

Security findings 1

Supply chain

highContextual riskmedium confidence

The skill instructs the agent to treat remote linked documentation as authoritative over the skill text and to fetch it when details matter, letting mutable remote content steer agent behavior.

skills/honcho-memory/SKILL.md:12

treat the linked docs (and your own live tool list) as authoritative and fetch them when the details matter

conceal:remotevector:instruction

Counter-argument considered

This is a concrete, reachable instruction in the skill body granting mutable remote docs authority over the skill's own actionable specifics (install commands, headers); no declared claim D1-D17 or carve-out covers this authority elevation, and the 'concepts change rarely — rely on them' scope-limit reduces severity but does not neutralize the live-override channel for volatile specifics.

Open questions 1

What the analysis could not settle from the code alone.

The skill states the Honcho MCP server injects its own usage guide on connect and 'tells your assistant how to use the tools automatically'; that injected instruction content is remote/dynamic and not present in the artifact, so whether it stays within tool usage cannot be verified from the shown evidence.

Tool poisoning

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

criticalRefutedlow confidence

The skill's resource list points the agent at an unpinned remote instruction document (a main-branch raw GitHub markdown file) as the full MCP usage walkthrough to consume.

skills/honcho-memory/SKILL.md:87

Full MCP usage walkthrough: <https://raw.githubusercontent.com/plastic-labs/honcho/refs/heads/main/mcp/instructions.md>

Why it was refuted

The pointing behavior is openly declared: declared claim D15 lists this exact URL in the Resources section and D11 declares the LLM Markdown docs-resource pattern, so the behavior is declared capability serving the declared 'raw MCP tools (covered here)' path — not undeclared or concealed — failing the undeclared and harm gates.

Supply chain

highRefutedlow confidence

The skill directs the agent toward installing the unpinned plastic-labs/claude-honcho plugin via a marketplace add command, pulling remote code into the agent environment.

skills/honcho-memory/SKILL.md:50

(`/plugin marketplace add plastic-labs/claude-honcho`) for persistent memory out of the box

Why it was refuted

The flagged install is the skill's declared core capability: the frontmatter directs the agent to connect via a first-class integration (preferred), and declared claim D3 states this exact marketplace command as mandatory, so the declared-core-capability carve-out and the undeclared gate both fail.

Coverage gaps 5

Parts of the artifact the static analysis could not fully examine.

context:decoded_views_exceeded 473 derived view(s) beyond the per-file view cap: decoded:unicode-escape

integrations/cursor/dist/hook.js

context:manifest_unparseable yaml: YAML aliases are not permitted

sandbox/compose.mock.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

sandbox/compose.real.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

sandbox/compose.yml

context:manifest_unparseable yaml: YAML aliases are not permitted

tests/compat_matrix/compose.yml