Provides answers by retrieving and synthesizing information from local text or markdown files using a retrieval-augmented generation approach.

This skill appears to implement a straightforward local RAG, which legitimately needs an OpenAI API key and access to a docs folder. Before installing: (1) confirm the registry metadata is updated to list OPENAI_API_KEY (the SKILL.md requires it but the manifest does not), (2) decide and restrict which docsPath will be used (avoid pointing it at broad/system folders to prevent accidental exposure of secrets), and (3) if you will supply an OPENAI_API_KEY, consider scoping or using a key with limited quota/permissions. If you need stronger assurance, ask the publisher for a full description and example run, and for explicit limits on which filesystem paths the skill will read.

Type: OpenClaw Skill Name: hk101-living-rag Version: 1.0.0 The `SKILL.md` defines a `docsPath` input parameter for a RAG skill, which, if not properly sanitized by the underlying implementation (not provided), could allow an attacker to specify arbitrary file paths (e.g., `/etc/passwd`, `../../sensitive_data`) leading to arbitrary file read or path traversal vulnerabilities. While file access is inherent to a RAG skill over local documents, the broadness of this input without explicit safeguards makes the skill design suspicious due to potential exploitation, rather than benign. There is no evidence of intentional malicious prompt injection or code in the provided files.