install-openviking-memory

SUSPICIOUS. The skill’s stated purpose and core capabilities mostly align, and the primary plugin install path appears to be the official OpenClaw/OpenViking workflow. However, the fallback route executes an unpinned npm helper at runtime and forwards API credentials to that helper, which raises meaningful supply-chain and credential-handling risk. Not malicious on current evidence, but risk is elevated enough to avoid a benign classification.