openviking-token-saver

OpenViking context database for AI agents — layered context loading (L0/L1/L2), semantic search, file-system memory management. Use when: (1) setting up Open...

This skill appears to implement an on-device context DB and token-tracking wrapper for OpenViking — its high-level claims match the code. Before installing, consider: (1) Review scripts (install.sh, setup-config.sh, viking.py) yourself — they will create ~/.openviking, a venv, and write ov.conf containing any API key you provide. (2) Avoid piping unknown remote scripts to bash; the optional Rust CLI installer uses a curl|bash pattern — prefer reviewing that script first or installing via cargo when possible. (3) Be careful which local paths you add: the CLI can read any files you point it at and will send their contents to the configured embedding/VLM providers, so do NOT add sensitive directories (password stores, SSH keys, private data) unless you understand and accept the risk. (4) Backup your shell rc (~/.zshrc/.bashrc) before running install.sh because it may append environment exports. (5) Consider running the skill in an isolated environment or VM, and inspect ~/.openviking/ov.conf after setup to confirm API endpoints and keys. If you need additional assurance, ask the author for a signed release or a pinned package version for openviking and avoid using the curl|bash installer.

Type: OpenClaw Skill Name: openviking-token-saver Version: 2.2.0 The skill bundle implements a context management system but utilizes several high-risk installation and configuration patterns. Specifically, 'scripts/install.sh' employs a 'curl | bash' pattern to execute a remote script from GitHub and modifies user shell configuration files (.zshrc/.bashrc) to persist environment variables. The 'scripts/setup-config.sh' script collects sensitive API keys and stores them in a local configuration file (~/.openviking/ov.conf). While these behaviors are functionally aligned with the stated purpose of integrating the OpenViking database, they constitute significant security risks and potential vulnerabilities (e.g., plaintext credential storage and unauthorized shell modification). Additionally, 'scripts/viking.py' contains a hardcoded absolute path in its shebang (/Users/wuguanhua/...), which is a functional flaw.