Install Openviking Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 2.0.1

Overview

This skill has a coherent OpenViking memory setup purpose, but it asks the agent to install and run mutable remote npm code and enables broad persistent chat memory with limited privacy guardrails.

Install only if you trust the OpenViking server and npm helper publisher, understand that chat content may be archived and recalled across sessions, avoid storing real secrets or personal data, and prefer a pinned or ClawHub-managed install path before allowing the fallback npx helper.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:116

Finding

Shell Command Injection Through Unquoted User-Controlled Configuration Values

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 116–143 and 276–299
Vulnerability Type: Command injection through unsafe shell-command construction
Risk Level: High

Vulnerable Code

The skill instructs the agent to retain an API key without validation:

text

### 4b. `API_KEY` (OPTIONAL)

> (CN) API Key 是什么？服务没开认证就直接说"没有"。
> (EN) What's the API Key? Say "none" if the server has no auth.

- "no" / "none" / "没有" / "空" / empty → `API_KEY=""` (you will skip the flag later).
- Otherwise store as-is.

It subsequently inserts collected values into shell-command templates:

bash

npx -y openclaw-openviking-setup-helper@latest --base-url BASE_URL [--api-key API_KEY] [--agent-prefix AGENT_PREFIX] [--account-id ACCOUNT_ID] [--user-id USER_ID]

The documented flag-construction rules are:

text

- Always pass `--base-url BASE_URL`.
- Pass `--api-key API_KEY` only if `API_KEY` is non-empty.
- Pass `--agent-prefix AGENT_PREFIX` only if the user gave one.
- `--account-id` / `--user-id` only if the root-key path requires them.

Technical Analysis

BASE_URL, API_KEY, ACCOUNT_ID, and USER_ID can originate from user input. The API key is explicitly stored “as-is,” while no strict character validation is specified for the account or user identifiers. Although the URL receives basic normalization, the instructions only require an http:// or https:// prefix and do not reject shell metacharacters.

These values are then represented as direct substitutions in a shell command. The skill does not require use of an argument-array execution API, shell escaping, or platform-specific safe quoting. If the implementing agent constructs a command string as shown and sends it to a shell, metacharacters in a supplied value can terminate or alter the intended command.

Validation of AGENT_PREFIX does not protect the other command arguments. Treating an API key as an opaque value is a ...[truncated 1463 chars]

Remediation

View remediation

Remediation Suggestions

1. Execute programs through a tool API that accepts an executable and an argument array, with shell interpretation disabled. For example, pass npx, -y, the package identifier, --base-url, and the URL as separate arguments.
2. Never build a shell command by concatenating user-controlled values.
3. Validate BASE_URL with a proper URL parser. Permit only supported HTTP schemes, reject control characters, and explicitly define whether URL credentials, fragments, and unusual ports are allowed.
4. Define strict formats and length limits for ACCOUNT_ID and USER_ID, based on the actual OpenViking schema.
5. Treat API keys as opaque secrets but pass them only through safe argument arrays or, preferably, protected standard input or environment variables supported by the installer.
6. If shell execution is unavoidable, apply platform-specific escaping using a well-tested library rather than handwritten quoting.
7. Add explicit instructions prohibiting command-string substitution and test values containing spaces, quotes, semicolons, command substitutions, pipes, newlines, and Windows command separators.
8. Avoid printing complete generated commands or subprocess output when it could disclose the API key.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:276

Finding

Execution of an Unpinned Mutable npm Installer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 276–299, 521–527, and 558–569
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

The backup installation path executes the current latest release directly from npm:

bash

npx -y openclaw-openviking-setup-helper@latest --base-url BASE_URL [--api-key API_KEY] [--agent-prefix AGENT_PREFIX] [--account-id ACCOUNT_ID] [--user-id USER_ID]

The multi-instance workflow uses the same mutable package reference:

bash

npx -y openclaw-openviking-setup-helper@latest --workdir ~/.openclaw-second --base-url ... --api-key ...

The uninstall workflow also retrieves and executes latest:

bash

npx -y openclaw-openviking-setup-helper@latest --uninstall

The helper is documented as performing security-sensitive operations:

text

This will:

1. Stop the OpenClaw gateway.
2. Back up `openclaw.json`.
3. Remove all OpenViking plugin config from `openclaw.json` (`plugins.entries.openviking`, `plugins.allow`, `plugins.installs.openviking`, `plugins.slots.contextEngine`).
4. Move the plugin directory to `disabled-extensions/` as backup.
5. Remove the helper env files (`openviking.env`, `.bat`, `.ps1`).

Technical Analysis

The @latest npm tag is mutable. Consequently, the code executed during installation, multi-instance configuration, or uninstall is not fixed to the version that was reviewed with this skill. npx -y can download and execute the selected package without a separate inspection or interactive confirmation.

No exact version, integrity digest, lockfile, signature check, or provenance verification is specified. A compromised publisher account, malicious package release, registry compromise, or unexpected breaking release could therefore change the effective executable payload after the skill itself has passed review.

The risk is amplified by the helper’s intended ...[truncated 1592 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version.
2. Verify the downloaded package against an expected cryptographic integrity digest before execution.
3. Require npm provenance or trusted publisher signatures where supported, and document the expected package owner and registry.
4. Update the pinned version only through a controlled review process that examines package contents, lifecycle scripts, transitive dependencies, and behavioral changes.
5. Prefer distributing an audited installer with the skill or using a trusted plugin-manager mechanism that enforces version and integrity metadata.
6. Disable or strictly review dependency lifecycle scripts during staging where feasible.
7. Run installation in a least-privileged environment and restrict access to unrelated credentials and files.
8. Avoid passing API keys on the command line, where they may be visible to the downloaded installer, process inspection tools, or logs. Use a protected input channel if supported.
9. Apply the same pinning and integrity requirements to installation, multi-instance setup, and uninstall so that no operational path silently reintroduces mutable code.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises automatic cross-session capture and recall of chat content, yet it does not require a clear up-front consent flow explaining that user data will be transmitted to an OpenViking server and retained across sessions. In a security/privacy context, silently enabling persistent memory and remote data transfer can expose sensitive information far beyond the user's immediate expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation list includes generic phrases like "set up memory", "add long-term memory", "RAG", and "semantic memory", which are not narrowly tied to this specific OpenViking install workflow. In a markdown skill description, such broad triggers can cause unintended invocation for ordinary discussion about memory features or retrieval concepts rather than explicit requests to install this plugin.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions require responding in Chinese whenever the first message contains Chinese characters, and otherwise in English. This imposes a language policy automatically without asking the user for their preferred language, which is a natural-language policy violation under the stated locale-choice rules.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is explicitly designed to collect, persist, and later recall user facts across sessions, and it encourages that behavior without strong guardrails around sensitive data handling. In practice, this can lead to storage of secrets, personal data, or regulated information in a remote memory system, increasing exposure if the server, logs, or access controls are weak.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill directs the agent to execute npx -y openclaw-openviking-setup-helper@latest, which fetches and runs remote code at install time without pinning an exact version or verifying integrity. This creates a supply-chain execution risk: a compromised maintainer account, poisoned dependency, or breaking update could cause arbitrary code execution on the host running the agent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The success workflow explicitly asks the user to test memory by providing a personal email address and then recalling it later. This normalizes storing personally identifiable information in long-term memory and demonstrates reproduction of that data across sessions, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This reference section again instructs use of npx -y openclaw-openviking-setup-helper@latest for multi-instance setup, causing the agent to download and execute unpinned remote code. Repeating the pattern in operational guidance increases the chance that unsafe execution happens outside the primary install path as well.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The uninstall path also uses npx -y ...@latest, so even removal of the plugin requires executing fresh remote code from npm. An attacker who compromises that package could abuse the trust associated with maintenance workflows to run arbitrary commands during uninstall, when users may be less suspicious.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 655)May include surrounding context.

md

## Important Rules

1. **Never ask the user to run commands.** You run everything via your shell tool.
2. **Never skip STEP 5 (connectivity check).** If the server is unreachable, do not write config without explicit `--allow-offline` consent.
3. **Never silently use `--force-slot`.** Slot replacement disables another plugin — always confirm with the user first.
4. **Never invent values.** If the user can't provide a required value, stop and tell them what to ask their admin.

Static analysis

No suspicious patterns detected.