RAG Search

Backend retrieval skill for structured search of occupational health standards and documents, returning relevant text with source and clause details.

The code implements a local RAG query but relies on an absolute workspace path and external embedding/rerank clients while declaring no config paths or credentials. Before installing: (1) confirm the runtime will host /root/.openclaw/workspace/rag_system/data/vectors.db and that returning raw DB content is acceptable; (2) ask the author for the implementations of embedding_client and search_pipeline (they may require API keys or network access); (3) require the skill manifest to declare any required config paths and env vars (e.g., API keys, DB location); (4) review embedding/rerank client code for outbound network calls or credential usage to avoid secret exfiltration; (5) avoid exposing this skill directly to end users until these questions are resolved.

Type: OpenClaw Skill Name: rag-search Version: 0.1.1 The skill is classified as suspicious due to its reliance on hardcoded absolute paths within the `/root` directory for importing modules and accessing a database file. Specifically, `handler.py` uses `sys.path.insert(0, '/root/.openclaw/workspace/rag_system/scripts')` and accesses `db_path = "/root/.openclaw/workspace/rag_system/data/vectors.db"`. While this file access is plausibly needed for the stated RAG search purpose, it grants the skill implicit broad permissions to system-level components and data, posing a supply chain risk if the external RAG system components are compromised. There is no clear evidence of intentional malicious behavior like data exfiltration or unauthorized command execution within the provided skill bundle itself.