install-openviking-memory

SUSPICIOUS: The skill’s overall purpose and most capabilities are coherent with installing an OpenClaw memory plugin, and the primary ClawHub path appears official. Risk comes from the backup installer: an unpinned `npx @latest` helper that receives API credentials and account scoping values, creating avoidable supply-chain and credential-forwarding exposure. No clear credential theft, covert exfiltration endpoint, or confirmed malware behavior was found.