Rag Retriever

RAG 2.0 检索系统，支持中文分词，混合向量与关键词搜索，智能文档分块与加权重排，自动生成 RAG 格式输出。

This skill appears to implement a legitimate RAG retriever, but exercise caution because: (1) the code will call the OpenAI Embeddings API if an OPENAI_API_KEY is available — that is not declared in the registry metadata or SKILL.md; providing a key will cause your texts to be sent to OpenAI. (2) npm install pulls heavy native deps (transformers, onnxruntime, sharp), so review resource/compatibility and run in a sandbox if possible. Before installing, either: (A) review src/embeddings.js and other source files to confirm what data is sent externally, (B) avoid setting OPENAI_API_KEY to force use of the local SimpleEmbedding fallback, or (C) run the skill in an isolated environment and inspect network traffic. If you plan to provide an API key, make sure you understand what documents/queries will be transmitted and consider data-sanitization or policy constraints. If you want to be extra safe, run tests locally and audit the code paths that call external APIs and write to ./data/.

Type: OpenClaw Skill Name: yuyonghao-rag-retriever Version: 0.1.1 The skill bundle implements a legitimate RAG (Retrieval-Augmented Generation) system featuring hybrid search (BM25 and vector), document chunking, and support for both OpenAI and local Transformers.js embeddings. The code (src/rag2.js, src/retriever.js) is well-structured, includes extensive tests, and follows standard practices for document retrieval systems. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the use of a Hugging Face mirror (hf-mirror.com) and standard environment variables for API keys are consistent with the tool's stated purpose.