markdownknowledge

将本地 Markdown 知识库与 OpenClaw 集成，支持语义检索和上下文注入。仅在用户触发时检索（搜索知识库、查一下知识库等），不主动注入。

What to check before installing/using this skill: - Understand data access: the skill will read every .md under the configured knowledge_path and write an index file. Remove or relocate any Markdown that contains secrets (API keys, private tokens, passwords) or sensitive personal data before building the index. - Decide about auto-refresh: some manifests default auto_refresh=true while SKILL.md claims trigger-only retrieval. If you want no background updates or automatic injection, set auto_refresh to false and verify the agent only invokes search when you request it. - Inspect and control init behavior: running the provided init will attempt to download ripgrep from GitHub and install it to ~/.local/bin. If you prefer not to allow automatic downloads, install ripgrep yourself or edit the script to skip ensure_ripgrep. - Review index contents: after building, open the index.json to confirm it does not contain unintended secrets before invoking the skill in a shared/online agent session. - Limit scope: set knowledge_path to a narrow directory containing only documents you are comfortable exposing to the agent; use exclude_patterns to skip folders with sensitive content. - Run in a safe environment first: consider running build/search locally in an isolated account/container to observe behavior, then integrate into your primary agent once satisfied. Confidence note: medium — most items are straightforwardly supported by the code, but some contradictory documentation entries (automatic injection vs trigger-only) and the auto-download behavior increase uncertainty; examining runtime config and running a manual build will resolve the remaining questions.

Type: OpenClaw Skill Name: markdown-knowledge Version: 1.1.2 The skill implements a local Markdown knowledge base with semantic search. The primary security concern is the `ensure_ripgrep` function in `scripts/knowledge_base.py`, which automatically downloads and installs a binary from GitHub (`BurntSushi/ripgrep`) during initialization. While this is intended to improve performance, downloading and executing remote binaries is a high-risk behavior that bypasses standard package management. The rest of the code, including the `SKILL.md` instructions and core logic in `src/knowledge_core.py`, appears aligned with the stated purpose of local document retrieval.