Skillv1.0.0

ClawScan security

OpenViking Setup · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

ReviewMar 16, 2026, 2:32 PM

Verdict: Review
Confidence: medium
Model: gpt-5-mini
Summary: The skill's purpose and code largely match (setting up an OpenViking memory store), but there are several inconsistencies and risky behaviors you should understand before running it (undeclared API-key usage, curl|bash installer, subprocess shell execution, and plaintext config with secrets).
Guidance: This skill appears to implement an OpenViking installer and config generator, but there are three things to watch before running it: (1) the package will ask for and store API keys (OpenAI/Anthropic/Volcengine) even though the registry metadata didn't declare them — confirm you're comfortable providing those keys; (2) it suggests running a curl | bash installer from raw.githubusercontent.com — inspect that script (open the URL in a browser) before executing or prefer installing only from PyPI or cloned source you review; (3) the setup writes your API keys into ~/.openviking/ov.conf in plaintext — ensure file permissions are restrictive (chmod 600) or use a secrets manager if available. Recommended precautions: review the remote install script contents and the included Python scripts, run the setup in an isolated environment (container/VM) if unsure, set minimal-scope API keys, and back up your OpenClaw config before changing it. If you want to proceed but reduce risk, skip the curl|bash step and install openviking only from a vetted source, and manually create the config with appropriately-secured credentials.

Review Dimensions

Purpose & Capability: concernThe skill claims to 'set up OpenViking' and the included scripts do perform installation, configuration file creation, workspace setup, and health checks — so capability matches purpose. However, the registry metadata declares no required environment variables or credentials even though both SKILL.md and scripts clearly require API keys (OpenAI/Anthropic/Volcengine) and optional provider config. The mismatch between declared requirements (none) and actual runtime needs is an incoherence and should be flagged.
Instruction Scope: concernInstructions and scripts operate on user home files (~/.openviking/ov.conf and ~/.openclaw/config.yaml), create workspace directories, and prompt for or read API keys from environment variables. That scope is appropriate for a setup tool, but the SKILL.md and setup script also instruct/perform network installs and recommend adding secrets into a plaintext JSON config file in the user's home — both expand the trust surface and should be considered sensitive actions.
Install Mechanism: concernThere is no formal install spec in registry metadata, but both SKILL.md and scripts instruct running 'pip install openviking' and a curl | bash command that fetches and executes a script from raw.githubusercontent.com. Fetching and piping remote install scripts to shell is a high-risk pattern (executes remote code). While GitHub raw is a common host, executing its contents without review is risky. The scripts also call subprocess.run(..., shell=True), which increases command-injection exposure if inputs were untrusted.
Credentials: concernThe skill metadata lists no required env vars, yet setup.py and the README prompt for provider selection and expect API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, VOLCENGINE_API_KEY, OPENVIKING_PROVIDER, OPENVIKING_WORKSPACE). Requiring API keys for embedding/VLM access is reasonable for the stated purpose, but the omission from declared requirements is an incoherence. Also, secrets are written directly into ~/.openviking/ov.conf (plaintext JSON), which is expected for local config but has implications for file permissions and leakage.
Persistence & Privilege: okThe skill does not request 'always: true' or otherwise force inclusion. It creates configuration under the user's home directory and workspace directories and prints instructions for adding OpenViking to the OpenClaw config but does not modify other skill or system-wide configurations. This level of persistence is typical and proportional for a setup tool.