Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
OpenViking
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed OpenViking memory plugin, but it needs review because it can install via unpinned npm code and enables persistent cross-session chat memory.
Install only if you want OpenClaw conversations to be stored and recalled through your OpenViking server. Prefer the ClawHub install path, avoid the `npx ...@latest` fallback unless you trust that npm helper at the time you run it, use env/file SecretRefs for API keys, and test memory with non-sensitive dummy facts. Review auto-capture, bypass, delete, and disable-slot controls before using it with confidential chats.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)
Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Content
## Important Rules 1. **Never ask the user to run commands.** You run everything via your shell tool. 2. **Never skip STEP 5 (connectivity check).** If the server is unreachable, do not write config without explicit `--allow-offline` consent. 3. **Never silently use `--force-slot`.** Slot replacement disables another plugin — always confirm with the user first. 4. **Never invent values.** If the user can't provide a required value, stop and tell them what to ask their admin.
- Confidence
- 80% confidence
- Finding
- Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
- The uninstall path also executes an unpinned remote npm package, so even cleanup actions can become an unexpected code-execution vector. Users may trust uninstall operations more and run them later, widening the exposure window to future malicious package updates.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
- The skill executes `npx -y openclaw-openviking-setup-helper@latest`, which fetches and runs remote code at install time without version pinning or integrity verification. If the upstream package is compromised or a breaking/malicious update is published, the agent will execute attacker-controlled code with the user's local privileges during installation.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
- This multi-instance example again relies on `npx -y ...@latest`, preserving the same supply-chain risk: arbitrary newly published code may be downloaded and executed when the skill runs. Because the skill is designed to operate autonomously via shell commands, compromise would directly affect the host environment and OpenClaw state.
Vague Triggers
Medium
- Confidence
- 89% confidence
- Finding
- The manifest lists trigger phrases such as "set up memory", "add long-term memory", "semantic memory", and especially "RAG", which are broad concepts used in many contexts beyond installing this specific OpenViking plugin. The description does not provide exclusion conditions or negative examples, so activation scope is not clearly constrained.
Missing User Warnings
High
- Confidence
- 94% confidence
- Finding
- The skill promotes installation of a plugin that automatically captures and recalls chat-derived information across sessions, but it does not provide a prominent up-front consent warning before beginning the workflow. This creates a privacy/security risk because users may enable persistent cross-session memory without understanding that personal or sensitive data will be stored and later retrieved automatically.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- The instructions require Chinese if the first message contains Chinese characters and English otherwise, which imposes a language policy automatically. This removes user choice and could conflict with organizational language/locale requirements, especially for multilingual users who may prefer a different language than the one inferred.
Ssd 3
Medium
- Confidence
- 88% confidence
- Finding
- The skill is explicitly designed to configure automatic long-term retention and recall of user-provided facts across sessions. In security context, that means personal or sensitive data shared in ordinary conversation may be durably stored and surfaced later, increasing exposure, breach impact, and compliance risk if users are not carefully warned and given controls.
Ssd 3
Medium
- Confidence
- 93% confidence
- Finding
- The verification flow encourages testing by storing and recalling an email address, which normalizes persistence of personally identifiable information in long-term memory. Using real PII as a demo increases the chance that sensitive user data is stored unnecessarily and may remain accessible across sessions or to other actors depending on configuration.
Static analysis
Detected: suspicious.destructive_delete_command, suspicious.install_untrusted_source
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL-AGENT.md:329
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL-ZH.md:424
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL.md:348
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- openclaw.plugin.json:79
- Evidence
"placeholder": "http://127.0.0.1:1933",