RAG System Builder

Build and deploy local RAG (Retrieval-Augmented Generation) systems with offline document processing, embedding models, and vector storage.

This skill provides useful, coherent templates for building a local RAG system, but pay attention to the following before installing or running anything: - Offline claim vs. reality: Despite claiming 'works completely offline', the Quick Start and code instruct you to download models with huggingface_hub.snapshot_download and allow SentenceTransformer to load models by name (which will fetch from Hugging Face). Expect at least one network download to obtain model files unless you already have the model locally. - Network and disk usage: Model files are large (hundreds of MBs to GBs). Make sure you have enough disk space and bandwidth and that you trust the model source (the instructions point to Hugging Face's sentence-transformers official repo, which is standard). - Review code before running: The skill is instruction-only; it provides templates that will create and run Python code and a Flask web endpoint. Inspect the generated files (rag.py, web_interface.py, ingestion scripts) before running, especially if you plan to host the web UI on a machine accessible to others, since it will expose your ingested document contents over HTTP. - Run in an isolated environment: Use a virtualenv or container to avoid polluting your system Python environment. If you want to limit risk, run ingestion and model downloads on an isolated VM or sandbox. - No secret exfiltration detected: There are no required credentials or obfuscated endpoints in the provided files, and the regex scanner found no issues. However, because the skill instructs network downloads and runs code templates created at runtime, always validate the exact commands and code you execute. If you want a truly offline workflow, ensure you manually download and place the model files into the indicated local_model_path and avoid running the snapshot_download or online fallback steps.

Type: OpenClaw Skill Name: rag-system-builder Version: 1.0.0 The skill provides a template for building a local RAG system but contains a shell injection vulnerability in USAGE.md, where os.system() is used with f-strings to process document folders. Additionally, the provided Flask web interface example in USAGE.md enables debug=True, which is a security risk that can lead to remote code execution (RCE) via the interactive debugger. While these appear to be unintentional coding flaws in a tutorial context rather than intentional malware, they represent significant security vulnerabilities.