huawei-cloud-openviking-agent-integration

SUSPICIOUS: the skill’s core behavior broadly matches its stated purpose of binding OpenViking memory into local coding agents, and most flagged command/data-flow items are documentation or localhost management. However, it requires root-level template/config modification across multiple agents and relies on on-demand third-party plugin installation from mirrors and GitHub fallbacks, which creates meaningful supply-chain risk and some credential-forwarding exposure if --api-key is used. No confirmed malware or overt exfiltration to unrelated external endpoints is shown, but the installation/provenance model is more expansive than ideal for a configuration skill.

The fragment appears to implement a deliberate OpenViking-to-OpenClaw integration with installation, persistent configuration, plugin enablement, and reversible cleanup. No direct malware behavior or explicit credential exfiltration is visible. It does introduce a third-party plugin into startup execution and passes an API key to that plugin, so the plugin and configured endpoint must be trusted. Direct interpolation of shared_dir into a sourced shell command and variable-based rm -rf operations are security risks requiring validation. Assessment is limited because the file and plugin installation logic are truncated.

The fragment appears intended for legitimate plugin provisioning and contains no direct evidence of malware. The SHA-1 verification provides meaningful protection against tampered raw mirrors when GitHub metadata is trusted. However, the unvalidated OPENVIKING_PLUGIN_API_URL can replace the metadata authority, and npm peer installation lacks lockfile/integrity controls and permits lifecycle scripts. These issues warrant security review and hardening before use in a high-trust supply chain.

No direct malware behavior is evident, but the implementation has a significant code-injection risk because untrusted shell arguments are interpolated into Python source executed with OV_PY. json_write() is especially dangerous because the value is evaluated as Python code. Inputs must be strictly trusted or the functions should be rewritten to pass arguments safely and serialize values with json.dumps().