The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches plugin source code and dependencies from external repositories (volcengine/OpenViking) using multiple mirrors. One of the configured mirrors, gh-proxy.com, is explicitly flagged by automated scanners as a phishing/malicious URL.
[REMOTE_CODE_EXECUTION]: During the integration process, the skill downloads and installs Node.js and TypeScript plugins (@openviking/*) into agent sandboxes. These plugins are executed with the agent's privileges to provide memory functionality.
[DYNAMIC_EXECUTION]: The skill dynamically modifies the agent's environment and application logic. Evidence includes:
Patching Python source files (e.g., interface_code.py and openviking_memory_provider.py in WorkSwarm) to inject new functionality at runtime.
Modifying sandbox start.sh templates to source and execute skill-injected scripts on every boot.
Using python -c to execute dynamically generated code blocks that manipulate JSON and YAML configurations.
[INDIRECT_PROMPT_INJECTION]: The skill generates and places AGENTS.md files in the agent's workspace containing specific behavioral protocols that instruct the agent on how to use the memory tools. This creates a surface for influencing agent behavior through processed data. Mandatory Evidence Chain:
Ingestion points: AGENTS.md in the sandbox workspace (detected in kimicode.sh, workswarm.sh, and openclaw.sh).
Boundary markers: None present to delimit or warn about instructions within these generated files.
Capability inventory: Modification of startup templates, code patching, and external plugin installation across multiple agents.
Sanitization: No sanitization of the injected instructions is observed.
[COMMAND_EXECUTION]: The skill executes various shell commands (curl, sed, chmod, npm install) and manages process environments to facilitate the integration and unbinding of memory services.

huawei-cloud-openviking-agent-integration