OpenViking Setup

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:07 AM UTC
• Version: 1.0.0

Overview

This setup skill is mostly aligned with OpenViking installation, but it uses high-impact install steps and stores credentials and persistent memory without enough safeguards.

Review this skill before installing. Prefer a virtual environment, pin package versions, avoid running the curl | bash installer unless you have inspected and pinned it, and store provider API keys using restrictive permissions or a secret manager. Treat OpenViking memory as durable local data that may include sensitive project context, and confirm which model providers will receive content for embeddings or VLM processing.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.py:70

Finding

Mutable Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Remediation

View remediation

/crates/ov_cli/install.sh' ``` 4. Verify the downloaded file using a publisher signature or a checksum distributed through a separate trusted channel. 5. Display the source, destination, version, and expected changes to the user before execution. 6. Require explicit confirmation before running the verified installer. 7. Prefer an official, versioned package-manager artifact where available. 8. Execute installation with ordinary user privileges and reject unnecessary elevation. 9. In Python, avoid `shell=True`; use an argument list for downloading and invoke the verified local script separately. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/setup.py:65

Finding

Unpinned Packages Are Installed with Forced Replacement

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.py:243

Finding

Provider API Key Is Written to a Plaintext File Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A setup skill that also performs undisclosed validation, reads existing user configs, or writes test memory entries expands its effective behavior beyond what the user is told to expect. That mismatch undermines informed consent and can lead to silent data inspection or persistence changes in sensitive agent memory stores.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The command chain using '| bash' is a classic arbitrary-code-execution pattern: untrusted network content is streamed directly into a shell interpreter. In a setup skill, this is especially dangerous because users expect installation steps to be trustworthy and may execute them without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

pip install openviking --upgrade --force-reinstall

CLI tool

curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/crates/ov_cli/install.sh | bash

text

### Step 2: Create Configuration

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Using subprocess.run("ov_cli --version", shell=True, ...) exposes the check to tool/path abuse because the shell resolves the command using the current environment. In an agent-operated setup workflow, an attacker who can influence PATH, shell startup behavior, or place a rogue ov_cli earlier in resolution may achieve arbitrary code execution when the health check runs.

Content

Scanner excerpt · scripts/health_check.py (reported line 26)May include surrounding context.

python

def check_cli():
    """Check if ov_cli is available."""
    result = subprocess.run("ov_cli --version", shell=True, capture_output=True)
    if result.returncode == 0:
        print("✓ OpenViking CLI installed")
        return True

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Using subprocess.run with shell=True allows shell metacharacter interpretation and turns command strings into a potential injection sink. Although current call sites are hardcoded, this pattern is unsafe by design and risky in agent tooling that may later evolve to include user-controlled parameters.

Content

Scanner excerpt · scripts/setup.py (reported line 16)May include surrounding context.

python

def run_command(cmd: str, check: bool = True) -> tuple[int, str, str]:
    """Run a shell command and return exit code, stdout, stderr."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script downloads a remote install script from GitHub and pipes it directly into bash, giving the remote content immediate code execution on the host. This is especially dangerous in an agent skill because users may trust automation and run setup steps without reviewing what code will execute.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup flow performs network retrieval and shell execution without an explicit warning or informed consent, so users may unknowingly run unreviewed remote code. In a setup context this elevates risk because installation tasks are expected to modify the system and may be run with broad permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The configuration embeds API keys into a JSON config object that is later written to disk, creating credential persistence without explicit notice. Stored secrets can be exposed through local compromise, backups, logs, or accidental sharing of the config file.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly contains operational shell commands, filesystem writes, and configuration handling, but it declares no explicit tool scope or permission boundaries. In an agent environment, that ambiguity can let the skill run with broader-than-expected capabilities, increasing the risk of unintended command execution, file modification, or secret exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when asked to 'configure context database for agents', 'implement persistent memory', or when 'memory management optimization is needed', and also lists triggers like 'context database' and 'tiered memory'. These phrases are broad enough to overlap with many general AI-agent or architecture discussions, making unintended invocation more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill sets up persistent configuration and workspace storage under the user's home directory, enabling long-lived retention of agent memory and provider credentials. Persistence is expected for this product, but it becomes security-relevant because stored context and API keys can accumulate sensitive data over time.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/crates/ov_cli/install.sh | bash

text

### Step 2: Create Configuration

Create `~/.openviking/ov.conf`:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to configure external API providers for embeddings and VLM processing, which may transmit stored memory, files, or retrieved context to third-party services. Without a privacy warning, users may unknowingly send sensitive agent memory or workspace data off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This configuration points embedding traffic to an external API endpoint, meaning content submitted for vectorization may leave the local environment. In a memory-management skill, that can expose sensitive documents, prompts, or long-term stored context if users are not explicitly warned and protected.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

},
  "embedding": {
    "dense": {
      "api_base": "https://api.openai.com/v1",
      "api_key": "your-openai-api-key",
      "provider": "openai",
      "dimension": 1536,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This VLM configuration sends model inputs to an external service, which may include agent memory, files, or retrieved context from the OpenViking workspace. In a persistent-memory system, the privacy impact is amplified because the transmitted content may contain accumulated sensitive history rather than a single prompt.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

"max_concurrent": 10
  },
  "vlm": {
    "api_base": "https://api.openai.com/v1",
    "api_key": "your-openai-api-key",
    "provider": "openai",
    "model": "gpt-4o",

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The example encourages initializing persistent storage with a default path under the user's home directory, which can lead agents to retain session data automatically without an explicit consent or retention policy step. In an agent-memory skill, this is more sensitive because stored context may include user preferences, project data, and session decisions, increasing privacy and unintended persistence risks.

Content

Scanner excerpt · references/examples.md (reported line 12)May include surrounding context.

python

from openviking import MemoryStore

# Create store with default config (~/.openviking/ov.conf)
store = MemoryStore()

# Or specify custom config path

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The script invokes a shell with shell=True for a command that does not require shell features. In an agent setup context, this makes execution depend on the ambient shell and PATH, increasing risk of executing a malicious ov_cli binary or shell-mediated behavior if the environment is compromised.

Content

Scanner excerpt · scripts/health_check.py (reported line 26)May include surrounding context.

python

def check_cli():
    """Check if ov_cli is available."""
    result = subprocess.run("ov_cli --version", shell=True, capture_output=True)
    if result.returncode == 0:
        print("✓ OpenViking CLI installed")
        return True

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file is presented as a health check and validation tool, but test_basic_operations() performs a real persistent write via store.add_memory(...). In an agent memory/database setup skill, unexpected state changes are security-relevant because they can pollute persistent memory, affect later agent behavior, and violate operator expectations of a read-only check.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The label and docstring 'Test basic operations' understate that the function writes to durable memory rather than merely validating connectivity or permissions. In this skill context, misleading documentation increases the chance an operator or agent runs it automatically and silently changes long-lived context state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs store.add_memory(...) without warning or confirmation immediately before the write. Because this skill configures persistent agent memory, silent writes are more dangerous than in an ordinary local utility: they can seed or contaminate memory stores that downstream agents trust.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The helper executes arbitrary shell strings with shell=True, which creates unnecessary command-injection risk and expands the attack surface if any command content becomes variable now or in future edits. In a setup skill, this is more dangerous because installation scripts often run with elevated privileges and touch the local environment.

Content

Scanner excerpt · scripts/setup.py (reported line 16)May include surrounding context.

python

def run_command(cmd: str, check: bool = True) -> tuple[int, str, str]:
    """Run a shell command and return exit code, stdout, stderr."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.py (reported line 108)May include surrounding context.

python

embedding_model: str = "text-embedding-3-small",
    embedding_dimension: int = 1536
) -> dict:
    """Create OpenViking configuration."""
    return {
        "storage": {
            "workspace": workspace

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.py (reported line 140)May include surrounding context.

python

"""Get default config for known providers."""
    configs = {
        "openai": {
            "api_base": "https://api.openai.com/v1",
            "model": "gpt-4o",
            "embedding_model": "text-embedding-3-small",
            "embedding_dimension": 1536

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.py (reported line 146)May include surrounding context.

python

"embedding_dimension": 1536
        },
        "anthropic": {
            "api_base": "https://api.anthropic.com/v1",
            "model": "claude-3-5-sonnet-20241022",
            "embedding_model": "text-embedding-3-small",  # OpenAI for embedding
            "embedding_dimension": 1536

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script writes configuration to ~/.openviking/ov.conf and may overwrite existing local state without an explicit warning or confirmation. While typical for installers, silent file creation/overwrite can cause data loss or unintended persistence of sensitive settings.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Fetching an install script from the network and piping it directly to a shell removes opportunities for integrity verification, review, or sandboxing. If the remote source, transport path, or referenced repository is compromised, arbitrary code executes immediately on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

pip install openviking --upgrade --force-reinstall

CLI tool

curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/crates/ov_cli/install.sh | bash

text

### Step 2: Create Configuration

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example stores the preference string "User prefers concise responses in Portuguese," which encodes a fixed language choice. Because this markdown example presents a language constraint without any opt-in or alternative, it can conflict with organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.