ov-memory-doctor
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute an installation script from the official Volcengine GitHub repository to resolve plugin registration errors.
- Evidence:
bash <(curl -fsSL https://raw.githubusercontent.com/volcengine/OpenViking/main/examples/memory-plugin-shared/install.sh) --harness claudeinSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources for installation, updates, and documentation.
- Evidence: References to
raw.githubusercontent.com/volcengine/OpenViking,github.com/volcengine/OpenViking, anddocs.openviking.aithroughoutSKILL.md. - [COMMAND_EXECUTION]: The skill executes local diagnostic scripts and system commands (such as
curl,lsof, anddocker logs) to troubleshoot the plugin and server environment. - Evidence:
node ${CLAUDE_PLUGIN_ROOT}/scripts/ov-memory-doctor.mjsand various manual debug commands inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes data from logs and external API responses, which are potential vectors for indirect prompt injection.
- Ingestion points: The skill reads
~/.openviking/logs/cc-hooks.logand evaluates responses from/healthand/readyendpoints of the OpenViking server. - Boundary markers: There are no explicit instructions to use delimiters or ignore potential commands embedded within the logs or server messages.
- Capability inventory: The skill is permitted to use
Bashto perform network requests and execute scripts. - Sanitization: No sanitization or filtering of the ingested external content is described before it is processed by the agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/volcengine/OpenViking/main/examples/memory-plugin-shared/install.sh - DO NOT USE without thorough review
Audit Metadata