OpenViking
v1.0.3RAG and semantic search via OpenViking Context Database MCP server. Query documents, search knowledge base, add files/URLs to vector memory. Use for document Q&A, knowledge management, AI agent memory, file search, semantic retrieval. Triggers on "openviking", "search documents", "semantic search", "knowledge base", "vector database", "RAG", "query pdf", "document query", "add resource".
⭐ 8· 4.2k·34 current·38 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (RAG, semantic search, add resources) align with the instructions and files: the skill directs you to clone OpenViking, run its MCP server, and use it for queries, search, and adding resources. Requested resources (API keys for embeddings and LLM) are coherent with a hosted embedding/LLM backend.
Instruction Scope
SKILL.md stays on-scope: it instructs cloning the repo, creating ov.conf, starting a local server, and using MCP to query/add resources. It explicitly asks you to add local files/URLs to the knowledge base — which will cause those contents to be processed (embedded and sent to the configured external APIs). It does not instruct reading unrelated system files or harvesting credentials, but adding files can result in data leaving your machine (to Volcengine) which is expected for the feature.
Install Mechanism
There is no packaged install spec; the init script clones https://github.com/volcengine/OpenViking and runs 'uv sync'. Cloning a known GitHub repo is expected for this skill, but 'uv sync' will install project dependencies and may execute install hooks in the repository — a moderate install risk because arbitrary repo code will be placed on disk and later executed when you run the server.
Credentials
The skill does not declare environment variables in metadata, but SKILL.md/init.sh require you to provide Volcengine/Ark API keys in ov.conf (embedding.dense.api_key and vlm.api_key). Those credentials are directly necessary for embeddings/LLM calls. This is proportionate to the stated purpose, but these keys grant an external provider access to any content you add — treat them like sensitive credentials and do not reuse high-privilege keys.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide privileges. It instructs creating files under the user's home (~/code/openviking) and running a local server bound to 127.0.0.1 by default. It does not modify other skills or global agent config automatically.
Assessment
This skill appears to do what it claims (run a local OpenViking MCP server and use Volcengine for embeddings/LLM). Before installing: 1) Review the GitHub repo and server.py in the cloned code to confirm you trust it; 'uv sync' may run install hooks. 2) Be aware that any local files or URLs you add will be sent to the configured Volcengine APIs — do not upload sensitive or regulated data unless you understand the provider's policy. 3) Protect the Ark API keys you add to ov.conf (use keys with minimal scope) and do not share them. 4) Consider running the server in an isolated environment (VM/container) if you want extra safety. If you need confirmation that the remote repo is unchanged, fetch its release signatures or inspect the code before running.Like a lobster shell, security has layers — review code before you run it.
latestvk97cdpcdrq9vrvw8m24sfr5bk581395q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.