← Back to Skills Marketplace
tangweigang-jpg

Dspy Prompt Optimizer

by Tang Weigang · GitHub ↗ · v0.1.0 · MIT-0
cross-platform ⚠ suspicious
65
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install dspy-prompt-optimizer
Description
DSPy：把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架。通过 14 个 teleprompter（optimizer）从 train + dev 集自动编译 prompt 与 few-shot demo。 DSPy: a Python framework for...
README (SKILL.md)

这个 skill 适合什么用户？能做哪些任务？

概览

DSPy 是把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架（github.com/stanfordnlp/dspy）。可插拔 Adapter 格式化消息和解析响应；LM 客户端层包装 LiteLLM 提供统一 provider 访问；14 个 teleprompter （optimizer）类从 train + dev 集自动编译 prompt 和 few-shot demo。

下层是 2 层缓存（LRUCache 内存 + diskcache FanoutCache 磁盘）和 3 层遥测（Settings.trace、Module.hist...

Doramagic 晶体页: https://doramagic.ai/zh/crystal/dspy-prompt-optimizer

知识规模

  • 44 条约束 (8 fatal + 36 non-fatal)
  • 上游源码: stanfordnlp/dspy @ commit da4ae194
  • 蓝图 ID: finance-bp-137

用法

Host AI（Claude Code / Cursor / OpenClaw）读 references/seed.yaml，按其中的：

  • intent_router 匹配用户意图
  • architecture 理解项目架构
  • constraints 应用 anti-pattern 约束
  • business_decisions 参考核心设计决策

FAQ 摘要

这个 skill 适合什么用户？能做哪些任务？

适合需要把 LLM 流水线工程化的研究员和工程师：用 Signature 替代手写prompt、用 teleprompter（如 MIPROv2、BootstrapFewShot）从数据自动优化 prompt + few-shot。覆盖 RAG / agent / 分类 / 抽取等用例。访问 doramagic.ai/r/dspy 查看完整说明。

需要准备什么环境？依赖什么？

Python 3.10+，至少一个 LM provider 通过 LiteLLM 访问（默认接受 'provider/model' 字符串如 'openai/gpt-4o-mini'）；可写磁盘用于 ~/.dspy_cache（或 DSPY_CACHEDIR 覆盖）。MIPROv2 离散搜索可选 optuna（懒加载）；asyncify 可选 anyio。

会踩哪些坑？这个 skill 怎么防护？

本 skill 内置 44 条约束（8 条 fatal）。CRITICAL 安全坑：(1) 默认 Cache(restrict_pickle=False) + diskcache pickle.load 在被污染的 ~/.dspy_cache shard 上 = RCE，无用户 opt-in；(2) MIPROv2 估算 LM 调用数但不在超预算时中止（静默失控成本）；

完整文档: 见 references/seed.yaml (v6.1 schema). 浏览页: https://doramagic.ai/zh/crystal/dspy-prompt-optimizer

Usage Guidance
This skill appears to be legitimate documentation for a Python prompt-optimizer framework, but there's an important mismatch: the skill's instructions expect the host to run python commands and read/write home/workspace files (e.g., ~/.dspy_cache, ~/.zvt) even though the skill metadata declares no required binaries/config. Notably, the skill itself warns that the default diskcache+pickle behavior can lead to RCE if untrusted cache shards are loaded. Before installing or invoking: (1) don't grant the agent arbitrary filesystem or Python execution privileges unless you trust the sources; (2) if you must run it, sandbox the execution (container/VM) and ensure cache directories are empty or use restrict_pickle=True / avoid loading pickled diskcache shards; (3) verify Python version and packages (zvt, optuna if used) locally rather than allowing the agent to run arbitrary install or check commands; (4) prefer pasting only the specific YAML sections the agent needs instead of granting broad FS access; and (5) ask the skill author for an explicit list of required binaries, env vars, and a safe configuration checklist (how to disable unsafe pickle loading) before proceeding.
Capability Analysis
Type: OpenClaw Skill Name: dspy-prompt-optimizer Version: 0.1.0 The skill bundle is a comprehensive knowledge base for using the DSPy and ZVT frameworks for AI engineering and quant trading. It contains no malicious code or exfiltration logic; instead, it includes proactive security constraints (e.g., dspy-C-001 and dspy-C-034 in references/seed.yaml) that explicitly instruct the AI agent to mitigate known vulnerabilities like RCE via pickle deserialization and malicious endpoint redirection. The shell commands are limited to environment checks and the installation of the legitimate 'zvt' library, and the instructions are focused on enforcing trading best practices and operational safety.
Capability Tags
cryptorequires-sensitive-credentials
Capability Assessment
ℹ Purpose & Capability
The skill claims to be a Python framework for prompt optimization and provides a comprehensive seed.yaml describing runtime behavior; that purpose aligns with instructions that operate on Python packages, caches, and blueprints. However, the skill metadata lists no required binaries or config paths even though seed.yaml and SKILL.md clearly expect python3, a writable cache dir (~/.dspy_cache or ~/.dspy_cache override), and access to workspace paths. This omission is an incoherence (missing declared requirements).
⚠ Instruction Scope
SKILL.md / seed.yaml instruct the host agent to re-read seed.yaml on behavioral decisions, run precondition python commands (e.g., import zvt, check/modify ~/.zvt), and rely on local caches. Those instructions can cause the host to execute arbitrary python commands and read/write user home files. The instructions also explicitly call out a dangerous default: Cache(restrict_pickle=False) + diskcache pickle.load on ~/.dspy_cache shards = potential RCE. The skill's runtime guidance therefore touches filesystem and execution beyond a simple prompt-help doc and includes acknowledged insecure defaults.
✓ Install Mechanism
This is an instruction-only skill with no install spec and no code files to install—lowest install risk. There is no download/extract or package installation declared in the skill bundle.
⚠ Credentials
The skill declares no required env vars or binaries, yet its text expects an LM provider string (LiteLLM integration), Python 3.10+, optional packages (optuna/anyio), and writeable cache dirs. It also expects access to ZVT packages/data and to host_workspace paths. The absence of these required entries from the declared metadata is a mismatch. Additionally, the documented default cache behavior (unrestricted pickle) is a sensitive configuration that can enable remote code execution if the host loads untrusted shards.
ℹ Persistence & Privilege
The skill does not request always: true and has no install-time persistence. It does instruct the host to read and use workspace and home directories (e.g., workspace/scripts, ~/.dspy_cache, ~/.zvt) while running, which is normal for a framework but increases the blast radius if the host performs disk loads unsafely. No evidence the skill tries to modify other skills or system-wide agent settings.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install dspy-prompt-optimizer
  3. After installation, invoke the skill by name or use /dspy-prompt-optimizer
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
DSPy programmatic prompt engineering skill — 44 constraints / 8 fatal. MIPROv2 cost + cache RCE pitfalls.
Metadata
Slug dspy-prompt-optimizer
Version 0.1.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Dspy Prompt Optimizer?

DSPy：把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架。通过 14 个 teleprompter（optimizer）从 train + dev 集自动编译 prompt 与 few-shot demo。 DSPy: a Python framework for... It is an AI Agent Skill for Claude Code / OpenClaw, with 65 downloads so far.

How do I install Dspy Prompt Optimizer?

Run "/install dspy-prompt-optimizer" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Dspy Prompt Optimizer free?

Yes, Dspy Prompt Optimizer is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Dspy Prompt Optimizer support?

Dspy Prompt Optimizer is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Dspy Prompt Optimizer?

It is built and maintained by Tang Weigang (@tangweigang-jpg); the current version is v0.1.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 Comments