← Back to Skills Marketplace
OpenViking Setup
by
engsathiago
· GitHub ↗
· v1.0.0
· MIT-0
400
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install openviking-setup
Description
Set up OpenViking context database for OpenClaw agents. OpenViking is an open-source context database designed specifically for AI agents with filesystem-bas...
Usage Guidance
This skill appears to implement an OpenViking installer and config generator, but there are three things to watch before running it: (1) the package will ask for and store API keys (OpenAI/Anthropic/Volcengine) even though the registry metadata didn't declare them — confirm you're comfortable providing those keys; (2) it suggests running a curl | bash installer from raw.githubusercontent.com — inspect that script (open the URL in a browser) before executing or prefer installing only from PyPI or cloned source you review; (3) the setup writes your API keys into ~/.openviking/ov.conf in plaintext — ensure file permissions are restrictive (chmod 600) or use a secrets manager if available. Recommended precautions: review the remote install script contents and the included Python scripts, run the setup in an isolated environment (container/VM) if unsure, set minimal-scope API keys, and back up your OpenClaw config before changing it. If you want to proceed but reduce risk, skip the curl|bash step and install openviking only from a vetted source, and manually create the config with appropriately-secured credentials.
Capability Analysis
Type: OpenClaw Skill
Name: openviking-setup
Version: 1.0.0
The skill bundle automates the installation of 'OpenViking' using high-risk patterns, specifically 'curl | bash' in SKILL.md and scripts/setup.py to execute a remote script from GitHub (volcengine/OpenViking). The setup script also contains a shell injection vulnerability by using subprocess.run(shell=True) with user-provided inputs and handles sensitive API keys for multiple LLM providers. While these behaviors are consistent with a setup utility, the lack of input sanitization and the reliance on unverified remote execution are significant security risks.
Capability Assessment
Purpose & Capability
The skill claims to 'set up OpenViking' and the included scripts do perform installation, configuration file creation, workspace setup, and health checks — so capability matches purpose. However, the registry metadata declares no required environment variables or credentials even though both SKILL.md and scripts clearly require API keys (OpenAI/Anthropic/Volcengine) and optional provider config. The mismatch between declared requirements (none) and actual runtime needs is an incoherence and should be flagged.
Instruction Scope
Instructions and scripts operate on user home files (~/.openviking/ov.conf and ~/.openclaw/config.yaml), create workspace directories, and prompt for or read API keys from environment variables. That scope is appropriate for a setup tool, but the SKILL.md and setup script also instruct/perform network installs and recommend adding secrets into a plaintext JSON config file in the user's home — both expand the trust surface and should be considered sensitive actions.
Install Mechanism
There is no formal install spec in registry metadata, but both SKILL.md and scripts instruct running 'pip install openviking' and a curl | bash command that fetches and executes a script from raw.githubusercontent.com. Fetching and piping remote install scripts to shell is a high-risk pattern (executes remote code). While GitHub raw is a common host, executing its contents without review is risky. The scripts also call subprocess.run(..., shell=True), which increases command-injection exposure if inputs were untrusted.
Credentials
The skill metadata lists no required env vars, yet setup.py and the README prompt for provider selection and expect API keys (OPENAI_API_KEY, ANTHROPIC_API_KEY, VOLCENGINE_API_KEY, OPENVIKING_PROVIDER, OPENVIKING_WORKSPACE). Requiring API keys for embedding/VLM access is reasonable for the stated purpose, but the omission from declared requirements is an incoherence. Also, secrets are written directly into ~/.openviking/ov.conf (plaintext JSON), which is expected for local config but has implications for file permissions and leakage.
Persistence & Privilege
The skill does not request 'always: true' or otherwise force inclusion. It creates configuration under the user's home directory and workspace directories and prints instructions for adding OpenViking to the OpenClaw config but does not modify other skill or system-wide configurations. This level of persistence is typical and proportional for a setup tool.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install openviking-setup - After installation, invoke the skill by name or use
/openviking-setup - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release. Installs and configures OpenViking context database for OpenClaw agents with tiered memory (L0/L1/L2), multi-provider support, and health check utilities.
Metadata
Frequently Asked Questions
What is OpenViking Setup?
Set up OpenViking context database for OpenClaw agents. OpenViking is an open-source context database designed specifically for AI agents with filesystem-bas... It is an AI Agent Skill for Claude Code / OpenClaw, with 400 downloads so far.
How do I install OpenViking Setup?
Run "/install openviking-setup" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is OpenViking Setup free?
Yes, OpenViking Setup is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does OpenViking Setup support?
OpenViking Setup is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created OpenViking Setup?
It is built and maintained by engsathiago (@engsathiago); the current version is v1.0.0.
More Skills