Rag Retrieve

Performs domain- and version-aware hybrid vector+BM25+metadata search on TiDB, with multi-query expansion and optional chain-of-retrieval for multi-hop queries.

Do not install blindly. Confirm with the author/source: (1) Why the registry shows no required env vars/binaries while SKILL.md lists python3, pymysql/aiohttp and five sensitive endpoints (OPENCLAW_LLM_ENDPOINT, TIDB_HOST, TIDB_PORT, EMBEDDING_ENDPOINT, RERANKER_ENDPOINT). (2) Where do the endpoints point (internal private network vs third-party SaaS)? If endpoints are external, your code and documents could be sent to them during embedding/reranking. (3) Whether 'user_codebase' must be enabled; if not needed, set user_codebase=false to avoid including local code. (4) What shell/file-system commands the skill will actually run — ask for a minimal runtime log or code snippet. Prefer to run the skill in an isolated environment with network controls and internal-only endpoints. If the author can't explain the registry/SKILL.md discrepancies or the endpoints' hosts, treat the skill as untrusted.

Type: OpenClaw Skill Name: rag-retrieve Version: 2.0.0 The rag-retrieve skill implements a sophisticated RAG pipeline featuring multi-query expansion, hybrid search in TiDB, and multi-hop retrieval (CoRAG). It utilizes local services for embeddings and reranking via shell-based curl commands and connects to a local TiDB instance. While the skill uses high-privilege tools and contains minor security flaws like hardcoded local database credentials (root with no password in SKILL.md), its behavior is entirely consistent with its stated purpose of document retrieval and lacks any evidence of malicious intent, data exfiltration, or unauthorized remote execution.