RAG and semantic search via OpenViking Context Database MCP server. Query documents, search knowledge base, add files/URLs to vector memory. Use for document Q&A, knowledge management, AI agent memory, file search, semantic retrieval. Triggers on "openviking", "search documents", "semantic search", "knowledge base", "vector database", "RAG", "query pdf", "document query", "add resource".
Security Analysis
medium confidenceThe skill's requirements and instructions are internally consistent with a local RAG/vector DB setup that uses Volcengine/Ark keys; the main risks are installing/starting third‑party code and sending uploaded files to an external API — behaviour that matches its stated purpose.
Name/description (RAG, semantic search, add resources) align with the instructions and files: the skill directs you to clone OpenViking, run its MCP server, and use it for queries, search, and adding resources. Requested resources (API keys for embeddings and LLM) are coherent with a hosted embedding/LLM backend.
SKILL.md stays on-scope: it instructs cloning the repo, creating ov.conf, starting a local server, and using MCP to query/add resources. It explicitly asks you to add local files/URLs to the knowledge base — which will cause those contents to be processed (embedded and sent to the configured external APIs). It does not instruct reading unrelated system files or harvesting credentials, but adding files can result in data leaving your machine (to Volcengine) which is expected for the feature.
There is no packaged install spec; the init script clones https://github.com/volcengine/OpenViking and runs 'uv sync'. Cloning a known GitHub repo is expected for this skill, but 'uv sync' will install project dependencies and may execute install hooks in the repository — a moderate install risk because arbitrary repo code will be placed on disk and later executed when you run the server.
The skill does not declare environment variables in metadata, but SKILL.md/init.sh require you to provide Volcengine/Ark API keys in ov.conf (embedding.dense.api_key and vlm.api_key). Those credentials are directly necessary for embeddings/LLM calls. This is proportionate to the stated purpose, but these keys grant an external provider access to any content you add — treat them like sensitive credentials and do not reuse high-privilege keys.
The skill is not always-enabled and does not request system-wide privileges. It instructs creating files under the user's home (~/code/openviking) and running a local server bound to 127.0.0.1 by default. It does not modify other skills or global agent config automatically.
Guidance
This skill appears to do what it claims (run a local OpenViking MCP server and use Volcengine for embeddings/LLM). Before installing: 1) Review the GitHub repo and server.py in the cloned code to confirm you trust it; 'uv sync' may run install hooks. 2) Be aware that any local files or URLs you add will be sent to the configured Volcengine APIs — do not upload sensitive or regulated data unless you understand the provider's policy. 3) Protect the Ark API keys you add to ov.conf (use keys with minimal scope) and do not share them. 4) Consider running the server in an isolated environment (VM/container) if you want extra safety. If you need confirmation that the remote repo is unchanged, fetch its release signatures or inspect the code before running.
Latest Release
v1.0.3
RAG and semantic search via OpenViking Context Database MCP server
Popular Skills
Published by @ZaynJarvis on ClawHub
