原子化RAG知识库构建器 - 让AI真正学会一本书，而非只是看过。理工农医特化，方法论提炼，全网最好的开源专属知识库建立技能。

This skill largely implements a reasonable PDF→RAG pipeline, but several red flags mean you should be careful before installing or running it: - Check package.json: it contains an apparent GitHub token embedded in the repository URL. Treat that as a leaked secret — do not reuse it, and avoid trusting it. If you plan to use this code, remove/rotate the token and confirm it is not active. - Expect to provide external credentials at runtime: OpenAI (or another embedding provider) API key, and any vector DB credentials (Chroma/Milvus/Pinecone). The skill does not declare these, but the code will call embedding/vector services. - System binaries are required but not declared: OCR (pytesseract) usually needs Tesseract installed on the host; pdf2image and pdf processing may need poppler. Install these in a controlled environment before running. - Run in an isolated environment first (sandbox/VM/container) and inspect network activity: the code will perform network calls to embedding providers and possibly vector DBs. Monitor outbound connections and avoid processing sensitive documents until you confirm where data is sent. - Review and test with non-sensitive PDFs: verify which external endpoints are contacted and what metadata/contents are transmitted (embeddings are generated by sending text to an embedding API). - If you will use this for medical content, be aware this code extracts diagnostic/treatment steps — ensure compliance with applicable regulations and have domain experts validate outputs. Given the evidence (missing declared env vars, system deps, and an embedded token), treat this skill as suspicious until you fix/confirm the issues above. If you want, I can point to the exact lines/files where environment-dependent calls are made and suggest specific mitigations (e.g., declare required env vars, remove tokens, add installation notes for system binaries).

Type: OpenClaw Skill Name: atomic-rag-knowledge-base Version: 1.0.0 The skill bundle provides a functional RAG (Retrieval-Augmented Generation) framework specialized for STEM document processing. However, it contains a critical security vulnerability: a hardcoded GitHub Personal Access Token (PAT) is exposed in the 'repository.url' field of the 'package.json' file. While this appears to be an unintentional credential leak by the developer rather than an intentional attack against the user, the presence of hardcoded secrets is a high-risk indicator. The core logic in 'builder.py' and 'rag.py' uses standard libraries (LangChain, pdfplumber) for its stated purpose without evidence of data exfiltration or malicious execution.