Rag Memory

Vector memory search and RAG skill for OpenClaw. Provides vector_search tool backed by Qdrant, auto-syncs memory .md files and Postgres records via nomic-emb...

This skill appears to implement what it claims, but review these items before installing: - Auto-injection: The plugin defaults to auto_inject=true and will automatically send (a slice of) user messages to your configured embedding endpoint and query Qdrant to prepend context. If you don't want that automatic network activity or potential data leakage, disable auto_inject in the plugin config. - Embedding endpoint trust: EMBED_BASE_URL/EMBED_API_KEY are the primary credentials; memory text is sent there for embedding. Only point this at services you control/trust (self-hosted LiteLLM, local Ollama, etc.). - Postgres credentials: POSTGRES_DSN gives DB access. Use a narrowly scoped, read-only account limited to the expected tables (memory_entries, daily_logs, tools, qdrant_sync_log). Do not give a full-admin DSN. - Missing/undeclared runtime binary: The bundle contains Node.js plugin and several node scripts that call /usr/bin/node, but the declared required binaries list omits node. Ensure node is available on the host (and the correct version) or add it to the required binaries before installing. - Systemd deployment: The provided deploy.sh copies files into /etc/systemd/system and enables timers — that requires sudo. Review the unit files (in systemd/) before running the deploy script. - Config and secrets handling: The repo expects a gitignored config.env with secrets. Confirm config.env is not committed and rotate keys as needed. Verify QDRANT_COLLECTION_PREFIX and EMBED_API_KEY values are set intentionally. - Audit third-party deps: package-lock.json includes many transitive packages (some named @anthropic, AWS libs, etc.). The plugin code itself does not call Anthropic/AWS APIs, but you may want to review node dependencies if you install the plugin into your runtime. If these points are acceptable and you lock down POSTGRES_DSN and your embedding/Qdrant endpoints, the skill is coherent with its stated purpose. If any of the above raise concerns (automatic outbound data, broad DB access, missing runtime binaries), treat the install as higher risk or change the defaults (disable auto_inject, create a read-only DB user, host your own embedding/Qdrant).

Type: OpenClaw Skill Name: rag-memory Version: 1.1.1 The rag-memory skill bundle implements a standard Retrieval-Augmented Generation (RAG) system using Qdrant for vector storage and an OpenAI-compatible embedding endpoint. The bundle includes a Python synchronization script (sync_to_qdrant.py), systemd units for automation, and a Node.js plugin (plugin/index.js) that provides a vector_search tool and automatic context injection. The code is well-documented, transparent about data flow to user-configured endpoints (QDRANT_HOST, EMBED_BASE_URL), and contains no evidence of malicious intent, obfuscation, or unauthorized data exfiltration.