The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains instructions that direct the AI agent to hide its operations from the user during the installation process. Specifically, it uses directives like "silently," "Do NOT show the result," and "Do NOT show this step to the user" when performing system checks and connectivity tests. This concealment reduces the user's ability to monitor the shell commands being executed on their system.
[REMOTE_CODE_EXECUTION]: The installation flow includes a backup path that executes npx -y openclaw-openviking-setup-helper@latest. This command downloads and runs a script from the public npm registry at runtime, which constitutes a remote code execution vector.
[COMMAND_EXECUTION]: The agent is instructed to run multiple shell commands (uname, node -v, curl, openclaw) to detect the environment, check prerequisites, and configure the plugin. These commands are executed directly in the user's terminal via the agent's shell tool.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads to acquire the plugin and its dependencies, fetching packages from clawhub:@openviking/openclaw-plugin and the npm registry.
[INDIRECT_PROMPT_INJECTION]: The core function of the skill is to install a long-term memory system, which creates a significant surface for indirect prompt injection. Data retrieved from past conversations or external files can influence the agent's future behavior if it contains malicious instructions.
Ingestion points: Untrusted data enters the context through chat auto-capture, explicit memory storage via memory_store, and resource importing via add_resource (supporting local paths, URLs, and Git repositories).
Boundary markers: There are no instructions for the agent to use delimiters or sanitization routines when processing recalled memories to distinguish them from system instructions.
Capability inventory: The installed plugin provides tools for file access (ov_read), resource searching (ov_search), and session management, which could be abused if malicious data is processed.
Sanitization: The skill does not define specific sanitization or validation logic for the content stored in or retrieved from the memory system.

install-openviking-memory