← 返回 Skills 市场

Dspy Prompt Optimizer

Name: Dspy Prompt Optimizer
Author: tangweigang-jpg

作者 Tang Weigang · GitHub ↗ · v0.1.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install dspy-prompt-optimizer

功能描述

DSPy：把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架。通过 14 个 teleprompter（optimizer）从 train + dev 集自动编译 prompt 与 few-shot demo。 DSPy: a Python framework for...

使用说明 (SKILL.md)

这个 skill 适合什么用户？能做哪些任务？

概览

DSPy 是把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架（github.com/stanfordnlp/dspy）。可插拔 Adapter 格式化消息和解析响应；LM 客户端层包装 LiteLLM 提供统一 provider 访问；14 个 teleprompter （optimizer）类从 train + dev 集自动编译 prompt 和 few-shot demo。

下层是 2 层缓存（LRUCache 内存 + diskcache FanoutCache 磁盘）和 3 层遥测（Settings.trace、Module.hist...

Doramagic 晶体页: https://doramagic.ai/zh/crystal/dspy-prompt-optimizer

知识规模

44 条约束 (8 fatal + 36 non-fatal)
上游源码: stanfordnlp/dspy @ commit da4ae194
蓝图 ID: finance-bp-137

用法

Host AI（Claude Code / Cursor / OpenClaw）读 references/seed.yaml，按其中的：

intent_router 匹配用户意图
architecture 理解项目架构
constraints 应用 anti-pattern 约束
business_decisions 参考核心设计决策

FAQ 摘要

这个 skill 适合什么用户？能做哪些任务？

适合需要把 LLM 流水线工程化的研究员和工程师：用 Signature 替代手写prompt、用 teleprompter（如 MIPROv2、BootstrapFewShot）从数据自动优化 prompt + few-shot。覆盖 RAG / agent / 分类 / 抽取等用例。访问 doramagic.ai/r/dspy 查看完整说明。

需要准备什么环境？依赖什么？

Python 3.10+，至少一个 LM provider 通过 LiteLLM 访问（默认接受 'provider/model' 字符串如 'openai/gpt-4o-mini'）；可写磁盘用于 ~/.dspy_cache（或 DSPY_CACHEDIR 覆盖）。MIPROv2 离散搜索可选 optuna（懒加载）；asyncify 可选 anyio。

会踩哪些坑？这个 skill 怎么防护？

本 skill 内置 44 条约束（8 条 fatal）。CRITICAL 安全坑：(1) 默认 Cache(restrict_pickle=False) + diskcache pickle.load 在被污染的 ~/.dspy_cache shard 上 = RCE，无用户 opt-in；(2) MIPROv2 估算 LM 调用数但不在超预算时中止（静默失控成本）；

完整文档: 见 references/seed.yaml (v6.1 schema). 浏览页: https://doramagic.ai/zh/crystal/dspy-prompt-optimizer

安全使用建议

This skill appears to be legitimate documentation for a Python prompt-optimizer framework, but there's an important mismatch: the skill's instructions expect the host to run python commands and read/write home/workspace files (e.g., ~/.dspy_cache, ~/.zvt) even though the skill metadata declares no required binaries/config. Notably, the skill itself warns that the default diskcache+pickle behavior can lead to RCE if untrusted cache shards are loaded. Before installing or invoking: (1) don't grant the agent arbitrary filesystem or Python execution privileges unless you trust the sources; (2) if you must run it, sandbox the execution (container/VM) and ensure cache directories are empty or use restrict_pickle=True / avoid loading pickled diskcache shards; (3) verify Python version and packages (zvt, optuna if used) locally rather than allowing the agent to run arbitrary install or check commands; (4) prefer pasting only the specific YAML sections the agent needs instead of granting broad FS access; and (5) ask the skill author for an explicit list of required binaries, env vars, and a safe configuration checklist (how to disable unsafe pickle loading) before proceeding.

功能分析

Type: OpenClaw Skill Name: dspy-prompt-optimizer Version: 0.1.0 The skill bundle is a comprehensive knowledge base for using the DSPy and ZVT frameworks for AI engineering and quant trading. It contains no malicious code or exfiltration logic; instead, it includes proactive security constraints (e.g., dspy-C-001 and dspy-C-034 in references/seed.yaml) that explicitly instruct the AI agent to mitigate known vulnerabilities like RCE via pickle deserialization and malicious endpoint redirection. The shell commands are limited to environment checks and the installation of the legitimate 'zvt' library, and the instructions are focused on enforcing trading best practices and operational safety.

能力标签

cryptorequires-sensitive-credentials

能力评估

ℹ Purpose & Capability

The skill claims to be a Python framework for prompt optimization and provides a comprehensive seed.yaml describing runtime behavior; that purpose aligns with instructions that operate on Python packages, caches, and blueprints. However, the skill metadata lists no required binaries or config paths even though seed.yaml and SKILL.md clearly expect python3, a writable cache dir (~/.dspy_cache or ~/.dspy_cache override), and access to workspace paths. This omission is an incoherence (missing declared requirements).

⚠ Instruction Scope

SKILL.md / seed.yaml instruct the host agent to re-read seed.yaml on behavioral decisions, run precondition python commands (e.g., import zvt, check/modify ~/.zvt), and rely on local caches. Those instructions can cause the host to execute arbitrary python commands and read/write user home files. The instructions also explicitly call out a dangerous default: Cache(restrict_pickle=False) + diskcache pickle.load on ~/.dspy_cache shards = potential RCE. The skill's runtime guidance therefore touches filesystem and execution beyond a simple prompt-help doc and includes acknowledged insecure defaults.

✓ Install Mechanism

This is an instruction-only skill with no install spec and no code files to install—lowest install risk. There is no download/extract or package installation declared in the skill bundle.

⚠ Credentials

The skill declares no required env vars or binaries, yet its text expects an LM provider string (LiteLLM integration), Python 3.10+, optional packages (optuna/anyio), and writeable cache dirs. It also expects access to ZVT packages/data and to host_workspace paths. The absence of these required entries from the declared metadata is a mismatch. Additionally, the documented default cache behavior (unrestricted pickle) is a sensitive configuration that can enable remote code execution if the host loads untrusted shards.

ℹ Persistence & Privilege

The skill does not request always: true and has no install-time persistence. It does instruct the host to read and use workspace and home directories (e.g., workspace/scripts, ~/.dspy_cache, ~/.zvt) while running, which is normal for a framework but increases the blast radius if the host performs disk loads unsafely. No evidence the skill tries to modify other skills or system-wide agent settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install dspy-prompt-optimizer
安装完成后，直接呼叫该 Skill 的名称或使用 /dspy-prompt-optimizer 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.0

DSPy programmatic prompt engineering skill — 44 constraints / 8 fatal. MIPROv2 cost + cache RCE pitfalls.

元数据

Slug dspy-prompt-optimizer

版本 0.1.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题