RAGLite - Local Expandable Library AI Library

Local-first RAG cache: distill docs into structured Markdown, then index/query with Chroma + hybrid search (vector + keyword).

This skill looks like a legitimate local RAG tool, but take precautions before installing/using it: - Be aware the wrapper will default to engine 'openclaw' unless you pass --engine explicitly; that can cause documents to be sent to an OpenClaw gateway. Always pass --engine <local|ollama|etc.> if you want to avoid outbound network usage. - The install script pip-installs from github:@main. Review the upstream repository (or request a pinned release/tag) before running install.sh and prefer installing in an isolated environment (container or VM). - If you have an OPENCLAW_GATEWAY_TOKEN in your environment, the installed library may use it even though the skill did not declare it. Remove or unset tokens you don't want used, or explicitly set a safe engine. - Ensure your Chroma server is local (chroma-url default is http://127.0.0.1:8100) and that ripgrep is installed if you need keyword search. - If you need higher assurance: clone and inspect the raglite repo code (or ask the author for a signed/pinned release) and run installs in a sandbox before trusting it with sensitive documents.

Package: raglite (xpi) Version: 1.0.6 Description: Local-first RAG cache: distill docs into structured Markdown, then index/query with Chroma + hybrid search (vector + keyword). The package installs its core functionality, the 'raglite' Python package, directly from the 'main' branch of an external GitHub repository (git+https://github.com/VirajSanghvi1/raglite.git@main) into a local virtual environment. This method of installation introduces a significant supply chain risk because the code executed is not version-pinned and can change at any time without explicit updates to the xpi package. A compromise of the external GitHub repository or malicious changes by its maintainer would directly affect users of this extension. The core logic of the 'raglite' Python package itself is not included in the provided source code for analysis, preventing a full security assessment of its functionality. The shell scripts otherwise perform standard virtual environment setup and command execution.