ragret-search

Search, retrieval, or knowledge-base intent when the user does not clearly mean local files only or the open web: curl a remote RAGret API for semantic retri...

This skill appears to be a simple helper for querying a RAGret server, but before installing: 1) Note that SKILL.md expects an API key (RAGRET_API_KEY) and a BASE/BASE_URL even though the package metadata doesn't declare those env vars — confirm how you'll supply them (set locally, not pasted into chat). 2) Verify and confirm the RAGret base URL before use (the skill defaults to http://127.0.0.1:8765 if unsure), since that will cause network calls to local or remote hosts. 3) Ensure you trust the RAGret instance you will query (it will receive queries and your API key via curl headers). 4) Ask the publisher to update the skill metadata to declare the required environment variables and primary credential so the permission surface is explicit. If you are uncomfortable with an agent making network requests or providing an API key, do not install or disable autonomous invocation for this skill.

Type: OpenClaw Skill Name: ragret-search Version: 1.0.0 The skill utilizes shell-based network access via `curl` to interact with a remote or local API, which is a risky capability. While the behavior is aligned with the stated purpose of RAG retrieval, the instructions in `SKILL.md` involve constructing shell commands using variables like `$BASE`, `INDEX_NAME`, and `$RAGRET_API_KEY`, which presents a risk of command injection or accidental data exfiltration if the agent does not properly sanitize user-provided inputs. The skill correctly includes instructions to avoid requesting raw secrets in chat, but the reliance on shell execution for API interaction warrants a cautious classification.