huawei-cloud-openviking-embedding-switch

• Outcome: Review
• Latest audit: Aug 17, 2026 · 8:32 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for OpenViking maintenance, but it can automatically delete vector index data, kill/restart services, and use a local exec API without enough path validation or confirmation safeguards.

Review before installing or running. Use only on a controlled OpenViking sandbox, verify the job-env-manager endpoint and SANDBOX_DIR resolve to the expected environment, take or confirm backups if the vector index matters, and expect service downtime during restart. Avoid running it in shared or production environments until destructive steps require explicit confirmation and validate paths before deletion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill performs shell execution, process control, and file modification/deletion, but it declares no explicit permissions or capability boundaries. This creates a trust and review gap: an agent may execute destructive local operations such as editing ov.conf, killing processes, and deleting vectordb data without a clear permission contract or user-visible warning.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger list contains generic phrases such as '配置openviking embedding', '切换向量化模型', and 'change openviking embedding model' that can match routine configuration requests without enough constraint that the user intends this specific high-impact skill. Because the skill edits configuration, deletes incompatible vector indexes, and restarts services, overly broad activation increases the chance of accidental invocation and unintended destructive changes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation recommends a destructive `rm -rf` operation that irreversibly deletes the vector database context, but it does not present a clear user-facing warning about data loss, backup expectations, or verification steps before execution. In an operational skill that automates embedding/model switching, this omission increases the chance of accidental data destruction during routine maintenance.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation describes destructive actions such as modifying ov.conf, deleting vectordb data when dimensions change, and killing/restarting the OpenViking process, but it does not explicitly warn the operator that these actions can disrupt service or cause data loss if misapplied. In a skill designed to automate infrastructure changes, omission of a clear user-facing warning increases the chance of accidental execution without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The troubleshooting guide instructs users to run `rm -rf` against the vectordb context directory without an explicit warning that this permanently deletes the existing index and may discard state required for recovery or investigation. In this skill’s context, deleting the index is sometimes operationally necessary to resolve an embedding-dimension mismatch, but documenting destructive deletion without clear safeguards increases the chance of accidental data loss.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide recommends `kill -9`/`pkill -9` as a manual fix for port conflicts without a prominent warning that forced termination can interrupt writes, leave inconsistent on-disk state, and cause lock or recovery issues. While not malicious, this is risky in a service-management skill because operators may normalize abrupt termination and use it prematurely instead of exhausting safer shutdown methods.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions delete `.openviking.pid` and `LOCK` files without clearly warning that doing so while a live process still owns the data directory can bypass safety mechanisms and lead to concurrent access or corruption. In this operational context, stale-lock cleanup can be valid, but the absence of a strict prerequisite to confirm no active server remains makes the procedure unsafe.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The verification workflow explicitly includes deleting `vectordb/context` when dimensions change and killing/restarting the OpenViking server, but it does not require any user confirmation, maintenance window check, backup validation, or warning about service interruption and index/data rebuild consequences. In an operational skill, these are destructive actions that can cause downtime, invalidate search state, and potentially lead to irreversible loss of local vector index data if performed unexpectedly or against the wrong environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 5b. Start new server via exec API
echo "  Starting new server via exec API..."
EXEC_RESP=$(curl -s --max-time 15 -X POST "${JEM_BASE}/envs/openviking/exec" \
  -H 'Content-Type: application/json' \
  -d '{"cmd":["bash","-c","nohup /root/runtime/openviking/venv/bin/openviking-server --config /workspace/process_dir/ov.conf > /workspace/process_dir/openviking-server.log 2>&1 & sleep 2 && echo started"]}' 2>&1) || true

• Confidence: 90% confidence
• Finding: The script sends a POST request to the local job-env-manager exec API that causes command execution inside the OpenViking sandbox. Although intended for lifecycle management, this is a privileged control-plane action, and if the local management API is exposed or spoofed, the script can be abused to launch attacker-chosen processes or restart services with hostile configuration.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "  Starting new server via exec API..."
EXEC_RESP=$(curl -s --max-time 15 -X POST "${JEM_BASE}/envs/openviking/exec" \
  -H 'Content-Type: application/json' \
  -d '{"cmd":["bash","-c","nohup /root/runtime/openviking/venv/bin/openviking-server --config /workspace/process_dir/ov.conf > /workspace/process_dir/openviking-server.log 2>&1 & sleep 2 && echo started"]}' 2>&1) || true

# BUG-5 fix: check exec API response
if echo "$EXEC_RESP" | grep -qi "error\|fail\|not found" 2>/dev/null; then

• Confidence: 83% confidence
• Finding: Using nohup with background execution creates a persistent detached server process that survives the invoking session. In an agent skill context, this can outlive user intent, complicate auditing, and provide a foothold for unintended long-running services if the restart path is triggered improperly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Task 4: Delete Incompatible vectordb Index

> **⚠️ Critical:** If dimensions differ, `rm -rf vectordb/context` is required. Otherwise `EmbeddingRebuildRequiredError` on startup.

If dimension is unchanged, skip this step.

• Confidence: 90% confidence
• Finding: The skill instructs deletion of a directory using rm -rf on live data as part of normal workflow, with only a logical precondition ('if dimensions differ') described in prose. If path resolution, sandbox directory detection, or variable handling is wrong, this can cause irreversible data loss; even when correct, it is a destructive operation that can be abused or triggered without adequate safeguards.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `vectordb/context/index/default/versions/` | Yes — index version data | Delete (will be recreated) |
| `viking/` metadata | No — user/session metadata is dimension-independent | Preserve |

**Simplest approach:** `rm -rf ${SANDBOX_DIR}/data/vectordb/context` — deletes everything under context, server recreates from scratch.

## start.sh Override Behavior

• Confidence: 96% confidence
• Finding: The documented command uses `rm -rf ${SANDBOX_DIR}/data/vectordb/context`, which is a powerful destructive primitive whose safety depends entirely on correct expansion of `${SANDBOX_DIR}`. If that variable is empty, malformed, or attacker-influenced, the deletion scope could broaden unexpectedly; in the context of a skill that modifies runtime configuration and restarts services, this makes the pattern materially dangerous rather than a purely theoretical concern.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Agent->>FS: Read ov.conf
    Agent->>FS: Write modified ov.conf<br/>(embedding.dense → llama endpoint)
    Agent->>FS: rm -rf vectordb/context<br/>(if dimension changed)
    Agent->>JEM: GET /envs/openviking<br/>(find server PID)
    Agent->>FS: kill old server PID
    Agent->>JEM: POST /envs/openviking/exec<br/>(start new server)

• Confidence: 92% confidence
• Finding: The documented use of rm -rf on vectordb/context is dangerous because destructive filesystem operations tied to configuration changes can be abused or mis-scoped, causing irreversible data loss if the path is incorrect, influenced by user-controlled input, or executed in the wrong working directory. The skill context increases risk because it performs automated host-side file and process management, so a mistake or parameter manipulation could delete important data beyond the intended index.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [ "$CURRENT_DIM" != "$TARGET_DIMENSION" ]; then
    echo "  Dimension mismatch: $CURRENT_DIM → $TARGET_DIMENSION"
    echo "  Deleting vectordb/context..."
    rm -rf "${SANDBOX_DIR}/data/vectordb/context"
    echo "  Deleted."
  else
    echo "  Dimensions match ($CURRENT_DIM), no deletion needed."

• Confidence: 95% confidence
• Finding: The script recursively deletes a directory path derived from SANDBOX_DIR, which itself comes from the job-env-manager API without validation. If that API returns an unexpected or attacker-controlled cwd, rm -rf could delete arbitrary filesystem locations outside the intended sandbox, causing destructive data loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

fi

# BUG-3 fix: clean up stale lock files
rm -f "${SANDBOX_DIR}/data/.openviking.pid" 2>/dev/null
find "${SANDBOX_DIR}/data/vectordb" -name "LOCK" -delete 2>/dev/null
echo "  Cleaned up lock files"

• Confidence: 93% confidence
• Finding: This removes a PID file using a path rooted in SANDBOX_DIR obtained from an external API without canonicalization or boundary checks. If the base path is maliciously influenced, the script may delete arbitrary files and the adjacent find ... -delete can expand the damage by deleting lock files outside the intended data directory tree.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

fi

# Cleanup backup
rm -f "${SANDBOX_DIR}/process_dir/ov.conf.bak"

echo ""
echo "=== Switch Complete ==="

• Confidence: 90% confidence
• Finding: The cleanup step deletes ov.conf.bak under a path derived from untrusted SANDBOX_DIR. While narrower than the recursive deletions above, it still permits unauthorized file deletion if the sandbox path is spoofed or manipulated.

Static analysis

No suspicious patterns detected.