install-openviking-memory

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to collect an API key from the user through conversation and then pass it as a direct command-line argument (e.g., --api-key API_KEY or --api-key ...) to setup helper tools and CLI commands. This causes the secret value to pass through the LLM context and appear in command outputs or execution history.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill instructs the agent to execute installation commands fetching packages from external registries via openclaw plugins install clawhub:@openviking/openclaw-plugin and npx -y openclaw-openviking-setup-helper@latest, constituting a common/reputable unofficial operational dependency.