RAGLite

Local-first RAG cache: distill docs into structured Markdown, then index/query with Chroma + hybrid search (vector + keyword).

Key things to check before installing/using RAGLite: - Understand the default engine behavior: the provided wrapper script will inject '--engine openclaw' if you don't pass --engine yourself, which causes the tool to use the OpenClaw gateway by default. That may send distilled document content to that gateway — do not run it on sensitive docs unless you trust the gateway and its operator. - OPENCLAW_GATEWAY_TOKEN is referenced in the docs but not declared in the skill metadata. Treat that as a sensitive credential: only set it if you trust the gateway and understand where requests go. - The install performs 'pip install git+...@main' (unpinning to main). Review the GitHub repo (https://github.com/VirajSanghvi1/raglite) before installing, and prefer a pinned release or commit SHA to avoid unexpected changes. Consider auditing the package's setup/entry points. - Ensure required local dependencies are present: python3 (3.11+), pip, ripgrep (rg) for keyword search, and a Chroma server if you intend to index locally. The skill metadata only listed python3/pip — install rg yourself if you need keyword matching. - If you want strictly local operation, explicitly pass a local engine (do not rely on the default) and confirm the tool is not configured to point to a remote Chroma instance or gateway. Run the install in an isolated environment (VM/container) if you want to limit risk. - If unsure, request the upstream repository URL and review its code (especially any install-time hooks) or ask the provider to publish a tagged release and declare required env vars.

Type: OpenClaw Skill Name: virajsanghvi1-raglite Version: 1.0.0 The skill bundle is classified as suspicious due to its installation method. The `scripts/install.sh` file installs the `raglite` package directly from a remote GitHub repository (`git+https://github.com/VirajSanghvi1/raglite.git@main`). This introduces a significant supply chain risk, as the integrity and security of the skill are dependent on the external repository. If the upstream repository were compromised, malicious code could be injected into the skill's runtime environment without direct modification of the provided skill bundle files.