Security audit

OpenViking

Security checks across malware telemetry and agentic risk

Overview

The skill’s memory purpose is disclosed, but its fallback installer can bypass ClawHub with an unpinned npm helper that changes OpenClaw plugin/config state.

Review this before installing if you do not want persistent chat memory or an agent changing OpenClaw plugin state. Prefer the primary ClawHub install path; avoid the npm fallback unless you explicitly accept unpinned external installer execution, and use env/file SecretRef handling for API keys where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to request and pass an API key to commands, but it provides no explicit user-facing warning about credential sensitivity, storage, logging, or exposure in process arguments. Because the agent is expected to run shell commands autonomously, the secret may be exposed via command history, process listings, tool logs, or persisted configuration without informed consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill advertises automatic capture of important facts from chats and cross-session recall, but does not require a clear privacy notice or affirmative user consent before enabling persistent memory. This can lead to unexpected retention and retrieval of sensitive personal or organizational data across sessions, especially because the feature is framed as automatic and always-on once installed.

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.install_untrusted_source

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL-AGENT.md:309
Evidence: rm -rf ~/.openclaw/extensions/openviking/

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL-ZH.md:406
Evidence: rm -rf ~/.openclaw/extensions/openviking/

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL.md:330
Evidence: rm -rf ~/.openclaw/extensions/openviking/

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:85
Evidence: "placeholder": "http://127.0.0.1:1933",