Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
Security audit
OpenViking
Security checks for vulnerabilities and agentic risk
Overview
The plugin is a coherent OpenViking memory integration, but its backup install and uninstall instructions run mutable remote npm code while also enabling persistent conversation memory.
Install only if you trust the OpenViking server and publisher. Prefer the primary ClawHub install path; avoid the `npx ...@latest` backup/uninstall helper unless you can verify the npm package/version. Review `autoCapture`, `autoRecall`, retention, and delete controls before using real personal or confidential data, and prefer SecretRef/env-based API keys over plaintext config.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Important Rules 1. **Never ask the user to run commands.** You run everything via your shell tool. 2. **Never skip STEP 5 (connectivity check).** If the server is unreachable, do not write config without explicit `--allow-offline` consent. 3. **Never silently use `--force-slot`.** Slot replacement disables another plugin — always confirm with the user first. 4. **Never invent values.** If the user can't provide a required value, stop and tell them what to ask their admin.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill executes
npx -y openclaw-openviking-setup-helper@latest, which fetches and runs remote code at install time without pinning an exact version or integrity. Because this skill is specifically designed to run commands automatically on the user's machine, a compromised publisher account, malicious new release, or dependency hijack could lead to arbitrary code execution during installation.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
This reference path again instructs the agent to execute
npx -y openclaw-openviking-setup-helper@latest, leaving the executed code mutable over time. In this context, the command targets state directories and configuration, so any malicious package update could execute arbitrary commands and tamper with local agent state.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The uninstall flow also uses
npx -y ...@latest, so even cleanup operations would execute unreviewed remote code. That creates an unnecessary trust boundary where an attacker could abuse a malicious release to run arbitrary code under the guise of uninstalling the plugin.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions require the agent to respond in Chinese whenever the first user message contains Chinese characters, and otherwise in English. This hard-coded language selection can override a user's preferred language or locale without explicit opt-in, which matches the language/locale policy violation category.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill is expressly designed to auto-capture and auto-recall user facts across sessions, which can include sensitive personal data. In a memory-plugin installation skill, this is more dangerous because it normalizes persistent storage before any granular consent, retention policy, data minimization, or sensitivity filtering is described.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The verification flow encourages storing and recalling an email address as a test case, which normalizes retention of personally identifiable information. In the context of an auto-memory system, this increases privacy risk by training users to place sensitive identifiers into persistent memory without emphasizing safer synthetic test data.
- Content
Static analysis
Detected: suspicious.destructive_delete_command, suspicious.install_untrusted_source
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL-AGENT.md:329
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL-ZH.md:424
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL.md:348
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- openclaw.plugin.json:79
- Evidence
"placeholder": "http://127.0.0.1:1933",