OpenViking Setup

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for setting up OpenViking, but it needs Review because it runs unverified remote installer code and persists API keys and memory state without enough safeguards.

Review before installing. Prefer a pinned or verified OpenViking release instead of the curl-to-bash command, avoid storing raw API keys in plaintext when possible, restrict permissions on any local config file, and do not run the health check against production memory unless you accept that it may add a test entry.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_cli():
    """Check if ov_cli is available."""
    result = subprocess.run("ov_cli --version", shell=True, capture_output=True)
    if result.returncode == 0:
        print("✓ OpenViking CLI installed")
        return True

• Confidence: 90% confidence
• Finding: The script invokes a shell with a string command (`shell=True`) just to check CLI availability. Even though the command is constant, shell execution unnecessarily exposes the check to PATH/environment manipulation and shell semantics, which is risky in an agent setup context where environment state may be less trusted.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd: str, check: bool = True) -> tuple[int, str, str]:
    """Run a shell command and return exit code, stdout, stderr."""
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,

• Confidence: 93% confidence
• Finding: The helper executes shell commands with shell=True, which is inherently risky because any future non-constant or user-influenced command string could become command injection. In this file the current call sites are mostly fixed strings, so the immediate exploitability is limited, but the pattern is still unsafe in an installer script that already performs privileged setup actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill contains operational capabilities including shell execution, file writes, and use of environment-backed secrets, yet it declares no permissions or safety boundaries. That mismatch can cause an orchestrator or user to invoke a skill with side effects they were not clearly warned about, increasing the chance of unintended system modification or secret exposure.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: A file labeled as a health check is expected to validate state, not mutate persistent application data. Here, the operations test writes a new memory entry to the OpenViking store, which can pollute the agent's long-term memory and create unintended side effects in downstream behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The main flow automatically triggers a state-changing database write when the basic checks pass, despite the script presenting itself as verification. In an agent memory system, even benign test data can persist and affect retrieval, context ranking, or later automated decisions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script downloads a remote installer from GitHub and pipes it directly to bash, giving whoever controls that content immediate code execution on the host. In a setup skill, this is especially dangerous because users expect to run it locally with their own permissions, making supply-chain compromise or upstream account compromise highly impactful.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases are broad enough to match generic requests about memory, context databases, or tiered memory, which could cause accidental invocation in unrelated situations. When a skill performs installs and configuration changes, overbroad triggering materially increases the risk of unrequested shell commands and persistent filesystem changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs installation and creation of a persistent configuration file in the user's home directory without any user-facing warning that it will modify the system. In a tool-using agent context, omission of explicit consent steps makes these side effects dangerous because they can be carried out automatically or with insufficient user awareness.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill recommends piping a remotely fetched script directly into `bash`, which executes unreviewed code from the network with the user's privileges. This is especially dangerous in an agent skill because it creates a direct path from remote content to code execution, enabling supply-chain compromise or tampered installer execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs a write operation without warning or obtaining confirmation from the user. In a setup/health-check skill, silent persistence is especially problematic because operators reasonably expect diagnostics to be side-effect free.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The installer executes a remote shell script without first warning the user or asking for confirmation. That removes an important safety checkpoint for a high-risk action and increases the chance that users will unknowingly execute unreviewed code.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script stores the API key in a local JSON config file under the user's home directory without warning about credential persistence or setting restrictive file permissions. If the file is readable by other local users, included in backups, or accidentally committed, the credential can be exposed.

Session Persistence

Medium

• Category: Rogue Agent

Content

curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/crates/ov_cli/install.sh | bash
```

### Step 2: Create Configuration

Create `~/.openviking/ov.conf`:

• Confidence: 82% confidence
• Finding: The skill instructs creation of a persistent config file under `~/.openviking`, establishing long-lived state on the host. Persistent session/config state is not inherently malicious, but in an agent skill it becomes security-relevant because it alters the user's environment and may store sensitive API configuration across sessions.

External Script Fetching

Low

• Category: Supply Chain

Content

pip install openviking --upgrade --force-reinstall

# CLI tool
curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/crates/ov_cli/install.sh | bash
```

### Step 2: Create Configuration

• Confidence: 97% confidence
• Finding: Fetching an external installer script from a raw URL introduces supply-chain risk because the fetched content can change over time or be tampered with upstream. In an automated agent context, even a low-friction fetch step is dangerous if there is no authenticity verification, pinning, or human review.

Chaining Abuse

High

• Category: Tool Misuse

Content

pip install openviking --upgrade --force-reinstall

# CLI tool
curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/crates/ov_cli/install.sh | bash
```

### Step 2: Create Configuration

• Confidence: 99% confidence
• Finding: The `| bash` chaining pattern converts network content directly into shell execution, removing any inspection boundary between retrieval and execution. This significantly amplifies the danger of the external script fetching behavior because compromise of the source, DNS, TLS trust, or repository content results in immediate arbitrary code execution.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.