本地知识库集成 - 文档检索、投喂、双轨模式切换

This skill appears to implement a local knowledge‑base frontend, which is reasonable. Before installing or enabling it, check the following: 1) The skill's openclaw_skill.py imports handle_request from scripts/openclaw_integration that is not included—find and review that module's source (E:/knowledge-base/scripts/openclaw_integration.py) to ensure it does not execute unwanted actions or exfiltrate data. 2) Confirm you trust the local API at http://127.0.0.1:8001 and the configured KB root (E:/knowledge-base); those endpoints/files could be read or written by the skill. 3) Because the skill executes local Python code, consider running it in an isolated environment (VM/container) or obtaining the complete source from a trusted origin. If you cannot inspect the missing module or verify the local service, treat the skill as potentially unsafe.

Type: OpenClaw Skill Name: knowledge Version: 1.0.0 The `openclaw_skill.py` file directly passes user-controlled input (extracted as `query`) to the `handle_request` function without explicit sanitization. This `handle_request` function is expected to interact with a local API service (`http://127.0.0.1:8001` as indicated in `SKILL.md`). This pattern creates a significant risk of injection vulnerabilities (e.g., shell injection, API parameter injection) if the `handle_request` implementation or the local API does not properly sanitize or escape the `query` before processing, potentially leading to unauthorized command execution or data manipulation on the local system.