← Back to Skills Marketplace
rrragflow-skill
by
redredrrred
· GitHub ↗
· v1.0.4
· MIT-0
130
Downloads
0
Stars
0
Active Installs
5
Versions
Install in OpenClaw
/install rrragflow-skill
Description
Use for RAGFlow dataset tasks: create, list, inspect, update, or delete datasets; upload, list, update, or delete documents; start or stop parsing; check par...
Usage Guidance
This skill appears to do what it says: it runs the included Python scripts against the RAGFlow API you point it at and requires only RAGFLOW_API_URL and RAGFLOW_API_KEY. Before installing, consider: (1) Only provide an API key for a RAGFlow instance you trust — the scripts will send that key to whatever URL you configure. (2) Upload commands read local files you specify (upload.py); don't upload sensitive files to a server you don't trust. (3) The SKILL.md requests the agent require explicit confirmation for deletes; the CLI requires --ids but the ultimate safety depends on the agent following that guardrail — confirm deletion prompts with the agent before proceeding. (4) If you need stronger guarantees, review upload.py and other scripts locally to confirm they only transmit intended files/fields. Overall, nothing in the package is disproportionate to its stated purpose.
Capability Analysis
Type: OpenClaw Skill
Name: rrragflow-skill
Version: 1.0.4
The skill bundle provides legitimate functionality for managing RAGFlow datasets and documents, but it is classified as suspicious due to the presence of high-risk capabilities that are explicitly mentioned in the analysis criteria. Specifically, the scripts `upload.py`, `update_dataset.py`, and `update_document.py` allow for arbitrary local file reading and uploading, including a feature to load JSON payloads from local paths using a '@' prefix. While these capabilities are plausibly needed for the stated purpose of document ingestion and configuration, they represent a significant attack surface for prompt injection, as an agent could be coerced into exfiltrating sensitive local files (e.g., JSON configuration files or credentials) to the user-provided `RAGFLOW_API_URL` endpoint.
Capability Assessment
Purpose & Capability
Name/description (RAGFlow dataset tasks) match the supplied scripts and CLI commands. Required binaries (python3) and required env vars (RAGFLOW_API_URL, RAGFLOW_API_KEY) are exactly what the scripts use; nothing in the manifest requests unrelated cloud credentials or system access.
Instruction Scope
SKILL.md explicitly instructs using only the bundled scripts and to set the two RAGFLOW env vars. The scripts call the configured RAGFlow HTTP API and format/return responses. The instructions do refer to uploading local files (upload.py) and to resolving dataset/document IDs before deletes; this is appropriate for the skill's purpose. Guardrails (explicit delete confirmation) are provided in SKILL.md; enforcement of confirmation relies on the agent following those guardrails (delete CLI requires --ids).
Install Mechanism
No install spec — instruction-only plus bundled scripts. No external downloads or installers are declared, so nothing arbitrary is written to disk beyond running the provided Python scripts.
Credentials
Only RAGFLOW_API_URL and RAGFLOW_API_KEY are required and declared; those are proportional to a tool that calls a RAGFlow HTTP API. The scripts use those env vars and do not reference other secrets or unrelated config paths.
Persistence & Privilege
always is false and the skill does not request permanent system-wide presence or modify other skills. Autonomous invocation is allowed (platform default) but does not combine with other concerning privileges here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install rrragflow-skill - After installation, invoke the skill by name or use
/rrragflow-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.4
- Added Openclaw metadata specifying required environment variables and binaries.
- Updated all example commands to use python3 instead of python.
- No logic or workflow changes; documentation and metadata clarifications only.
v1.0.3
- Removed 14 scripts and documentation files, including all essential dataset/document management and search scripts.
- The skill no longer includes the logic required for performing RAGFlow dataset or document operations directly.
- Updated credential prerequisites for clarity: `RAGFLOW_API_URL` and `RAGFLOW_API_KEY` must be set as environment variables.
- Documentation was adjusted to reflect these removals and explicitly note required environment setup.
v1.0.2
- Added explicit documentation of required environment variables (RAGFLOW_API_URL and RAGFLOW_API_KEY) to the skill metadata.
- Clarified credential requirements and descriptions in the Credentials section.
- No changes to functionality or workflow; only documentation/metadata updated.
v1.0.1
- Updated documentation to clarify scope and simplify instructions for using RAGFlow dataset and retrieval tasks.
- Shortened trigger phrase and workflow sections; now emphasizes use cases rather than exhaustive intent lists.
- Standardized usage examples to prefer `--json` output, with concise command samples.
- Output and error-handling rules now reference `reference.md` directly; emphasizes faithful relaying of API fields.
- Deletion guardrails clarified: explicit ID resolution and user confirmation required before any destructive actions.
- Added note specifying that RAGFLOW_API_KEY and base URL configuration are required.
v1.0.0
Initial public release of rrragflow-skill.
- Provides dataset management: create, list, inspect, update, and delete datasets.
- Supports document operations: upload, list, update metadata, and delete documents within datasets.
- Enables document parsing control: start, stop, and check parsing status and progress.
- Allows retrieval of knowledge chunks from RAGFlow datasets through search queries.
- Supports listing and inspecting available and unavailable models, with grouping and detail options.
- Chinese and English trigger phrases supported for all actions.
- Strict deletion workflow: explicit item listing and user confirmation required before destructive actions.
- Follows exact script output for status and error reporting; preserves API fields as returned.
Metadata
Frequently Asked Questions
What is rrragflow-skill?
Use for RAGFlow dataset tasks: create, list, inspect, update, or delete datasets; upload, list, update, or delete documents; start or stop parsing; check par... It is an AI Agent Skill for Claude Code / OpenClaw, with 130 downloads so far.
How do I install rrragflow-skill?
Run "/install rrragflow-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is rrragflow-skill free?
Yes, rrragflow-skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does rrragflow-skill support?
rrragflow-skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created rrragflow-skill?
It is built and maintained by redredrrred (@redredrrred); the current version is v1.0.4.
More Skills