Security audit

OpenViking

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent OpenViking memory plugin, but review is warranted because setup can change OpenClaw configuration through shell-driven install paths and then store chat history on a configured memory server by default.

Install only if you trust the OpenViking server and publisher. Prefer the normal ClawHub install path; avoid the npx @latest fallback unless you intentionally accept running external npm installer code. Expect chat turns to be sent to and stored on the configured OpenViking server unless autoCapture is disabled or sessions are bypassed. Use env/file SecretRefs for API keys, avoid storing secrets or real identifiers as test memories, and confirm before replacing an existing contextEngine slot.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list includes broad terms like 'RAG', 'semantic memory', and generic setup phrases that can fire in ordinary discussion rather than an intentional install request. In this skill, accidental activation is more dangerous because the workflow is designed to proceed into shell commands, network checks, and configuration changes with little initial confirmation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run commands silently, including OS detection, prerequisite checks, connectivity probes, plugin installation, config writes, and gateway restart. Silent execution reduces informed consent and auditability, increasing the risk of unauthorized system modification and making misfires from broad triggers materially more harmful.

Ssd 3

Medium

Confidence: 87% confidence
Finding: The reference section operationalizes durable storage, retrieval, and archive search over user facts and original messages. Even if this is core product functionality, it is security-relevant because it broadens the scope of retained conversational data and can expose sensitive historical content unless bounded by consent, retention, and access controls.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The skill normalizes automatic cross-session capture and recall of user facts and explicitly supports storing personal data such as email addresses. This creates privacy and data-minimization risk, especially if users do not fully understand that information will be durably stored on a remote memory server and later reused.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The success flow encourages testing by storing and recalling a user's email address across sessions, reinforcing persistence of sensitive personal information as a routine behavior. In context, this increases the chance that users disclose real identifiers into a long-term system without strong notice, retention controls, or least-data guidance.

VirusTotal

63/63 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.install_untrusted_source

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL-AGENT.md:309
Evidence: rm -rf ~/.openclaw/extensions/openviking/

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL-ZH.md:406
Evidence: rm -rf ~/.openclaw/extensions/openviking/

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL.md:330
Evidence: rm -rf ~/.openclaw/extensions/openviking/

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:84
Evidence: "placeholder": "http://127.0.0.1:1933",