OpenViking Setup

Set up OpenViking context database for OpenClaw agents. OpenViking is an open-source context database designed specifically for AI agents with filesystem-bas...

This skill appears to implement an OpenViking installer and config generator, but there are three things to watch before running it: (1) the package will ask for and store API keys (OpenAI/Anthropic/Volcengine) even though the registry metadata didn't declare them — confirm you're comfortable providing those keys; (2) it suggests running a curl | bash installer from raw.githubusercontent.com — inspect that script (open the URL in a browser) before executing or prefer installing only from PyPI or cloned source you review; (3) the setup writes your API keys into ~/.openviking/ov.conf in plaintext — ensure file permissions are restrictive (chmod 600) or use a secrets manager if available. Recommended precautions: review the remote install script contents and the included Python scripts, run the setup in an isolated environment (container/VM) if unsure, set minimal-scope API keys, and back up your OpenClaw config before changing it. If you want to proceed but reduce risk, skip the curl|bash step and install openviking only from a vetted source, and manually create the config with appropriately-secured credentials.

Type: OpenClaw Skill Name: openviking-setup Version: 1.0.0 The skill bundle automates the installation of 'OpenViking' using high-risk patterns, specifically 'curl | bash' in SKILL.md and scripts/setup.py to execute a remote script from GitHub (volcengine/OpenViking). The setup script also contains a shell injection vulnerability by using subprocess.run(shell=True) with user-provided inputs and handles sensitive API keys for multiple LLM providers. While these behaviors are consistent with a setup utility, the lack of input sanitization and the reliance on unverified remote execution are significant security risks.