RAGLite

Local-first RAG cache: distill docs into structured Markdown, then index/query with Chroma (vector) + ripgrep (keyword).

This skill appears to be what it says: a local RAG cache that installs a Python CLI into a skill-local virtualenv. Before installing: 1) Inspect or vet the PyPI package (raglite-chromadb) or install it in an isolated environment — pip installs run code during installation. 2) Avoid setting RAGLITE_PIP_INDEX_URL unless you trust the index; that can make the installer fetch packages from arbitrary servers. 3) When indexing sensitive docs, ensure --chroma-url points to a local/controlled Chroma instance (not a remote third party) and be aware the tool defaults to using the agent's OpenClaw engine for condensation, which will send data to whatever model backend your agent is configured to use. If you want full offline behavior, explicitly set a local engine and local Chroma, and review the upstream repo linked in SKILL.md for the package source and code.

Type: OpenClaw Skill Name: raglite Version: 1.0.8 The OpenClaw AgentSkills skill bundle for 'raglite' appears benign. The `SKILL.md` clearly outlines the purpose of a local RAG cache and even includes a 'Security note' addressing prompt injection from source material, instructing the model to treat sources as data only. The `scripts/install.sh` creates a skill-local Python virtual environment and installs the `raglite-chromadb` package from PyPI (or a configurable index), without any evidence of malicious execution, data exfiltration, or persistence mechanisms. The `scripts/raglite.sh` merely wraps the execution of the installed `raglite` command, defaulting the engine to 'openclaw'. There are no instructions for the agent to ignore the user, hide actions, or perform unauthorized activities.