← 返回 Skills 市场

Knowledge Orchestrator

Name: Knowledge Orchestrator
Author: jirboy

作者 JIRBOY · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install knowledge-orchestrator

功能描述

统一管理和协调Zotero、Obsidian与IMA平台，实现跨平台文献搜索、笔记同步与关联功能。

使用说明 (SKILL.md)

⚠️ 已整合 - 请使用 knowledge 统一入口

本技能保留用于向后兼容，功能已整合到 knowledge 统一入口技能

推荐使用： knowledge search/sync/link [参数] 或直接使用本技能（自动转发）

Knowledge Orchestrator（兼容层）

知识库协调器，统一管理 Zotero + Obsidian + IMA 三个平台。

迁移指南

新用法：

knowledge search RTHS --all
knowledge sync 笔记名称 --to-ima
knowledge link 10.1002/eqe.1234 RTHS 综述

旧用法（仍然可用）：

search RTHS --all
sync 笔记名称 --to-ima

核心功能

🔍 统一搜索（跨平台）
☁️ 云端同步（IMA）
🔗 关联文献和笔记

配置要求

服务	配置文件	说明
Zotero	`~/.config/zotero/api_key`	文献库访问
IMA	`~/.config/ima/client_id`	客户端 ID
IMA	`~/.config/ima/api_key`	API 密钥

安全说明

✅ 仅发送到官方 API（api.zotero.org, ima.qq.com）
❌ 不要分享凭据
❌ 不要硬编码在脚本中

安全使用建议

This skill appears to try to coordinate Zotero, Obsidian and an IMA service, which matches its name — but it is packaged poorly: it references sensitive config files (~/.config/zotero and ~/.config/ima) and imports local 'zotero-manager' and 'obsidian-manager' modules that are not included or declared. Before installing or running it: 1) treat it as untrusted code — inspect the missing modules (zotero_search.py, obsidian_search.py) and any network calls they make; 2) don't place real API keys in global ~/.config paths or run the skill on a machine with sensitive data until you verify what it reads/transmits; 3) prefer to run it in an isolated environment (VM/container) and monitor network traffic; 4) ask the publisher for the missing modules or a clear dependency list and for a project homepage or source repository to review. The issues look like sloppy packaging rather than clearly malicious intent, but the combination of undeclared credential access and dynamic imports is a real risk.

功能分析

Type: OpenClaw Skill Name: knowledge-orchestrator Version: 1.0.0 The 'knowledge-orchestrator' skill is a coordination layer designed to aggregate search results from Zotero, Obsidian, and IMA platforms. The primary logic in `knowledge_search.py` functions as a wrapper that imports local modules to perform searches and displays the results. While the skill handles sensitive API keys stored in local configuration files (e.g., `~/.config/zotero/api_key`), there is no evidence of data exfiltration, malicious execution, or prompt injection. The encoding issues (Mojibake) in `README.md` appear to be unintentional and do not pose a security risk.

能力标签

requires-sensitive-credentials

能力评估

⚠ Purpose & Capability

The skill declares no required environment variables or binaries in the registry, but the SKILL.md and code expect Zotero and IMA credentials stored under ~/.config (api_key, client_id) and import local submodules for Zotero/Obsidian. Requesting local config files and importing other modules is reasonable for a cross-platform orchestrator, but the registry should list these needs; the mismatch suggests incomplete or sloppy packaging.

⚠ Instruction Scope

SKILL.md explicitly instructs use of credential files at ~/.config/zotero/api_key and ~/.config/ima/{client_id,api_key}. The included Python script also modifies sys.path to import zotero/obsidian managers from parent directories. Those instructions require reading local sensitive files and executing code from adjacent modules — actions beyond a simple read-only 'search' description and not declared in the skill metadata.

ℹ Install Mechanism

No install spec (instruction-only) which reduces installer risk, but a non-trivial code file is included. The script depends on additional local modules (zotero-manager, obsidian-manager) that are not in the manifest; running the script will import and execute code from the filesystem, so the absence of those files in the package is a packaging / dependency concern.

⚠ Credentials

Registry lists no required environment variables or primary credential, yet SKILL.md and the code expect sensitive API keys stored in local config paths. Sensitive items (api_key, client_id) are referenced but not declared — this is disproportionate and increases the chance of surprise exposure if the agent reads those files. The skill also alters sys.path which could allow execution of arbitrary local code.

✓ Persistence & Privilege

The skill does not request persistent 'always' inclusion and allows normal agent invocation. It does not declare actions that modify other skills or global agent config. No elevated platform privileges are requested in the manifest.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install knowledge-orchestrator
安装完成后，直接呼叫该 Skill 的名称或使用 /knowledge-orchestrator 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

- Skill functions have been fully integrated into the unified knowledge entry skill. - Existing commands are preserved for backward compatibility, but now auto-forward to the new system. - Recommended to use `knowledge search/sync/link [parameters]` for future operations. - Supports unified search, cloud sync to IMA, and linking literature and notes. - Updated usage instructions and configuration guidance included.

元数据

Slug knowledge-orchestrator

版本 1.0.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题