ragtop-planner

面向外部 OpenClaw 的达人推广方案制定 Skill。基于 RAGTOP 三个工具接口（list_kb/list_doc/retrieval）执行四阶段工作流：规则提炼、案例总结、达人筛选、方案生成。

This skill appears coherent and implements what it claims: it will call a RAGTOP service using the provided RAGTOP_API_TOKEN and optional RAGTOP_API_URL, retrieve documents, and synthesize a plan. Before installing, confirm these points: (1) Verify you intend the agent to contact the RAGTOP host—SKILL.md defaults to an internal IP (http://10.71.10.71:9380); change RAGTOP_API_URL if that is not your service. (2) Provide a token with the least privilege needed and confirm the token's tenant/scope; the token gives access to knowledge bases and document contents. (3) Understand that retrieved documents and user queries will be sent to the RAGTOP service—do not use a token that grants access to sensitive data you don't want exposed. (4) Ensure your agent environment can make outbound HTTP calls (the docs use curl) and that network routing to the default host is expected. (5) The skill uses LLM prompts to avoid hallucinations and require traceability, but you should still review generated plans and citations before acting. If you are concerned about autonomous invocation, restrict or audit when the skill can be used or require explicit user invocation.

Type: OpenClaw Skill Name: ragtop-planner Version: 1.0.2 The skill is classified as suspicious primarily due to the default `RAGTOP_API_URL` being hardcoded to a private IP address (`http://10.71.10.71:9380`) in `SKILL.md` and `references/workflow.md`. While the skill's stated purpose is to interact with an internal RAGTOP service, this default configuration presents a potential Server-Side Request Forgery (SSRF) vulnerability. If the agent's execution environment allows access to other internal services, and the URL could be manipulated (e.g., via environment variable override or prompt injection if the agent were to dynamically construct the URL based on user input), it could be exploited. No other malicious indicators such as data exfiltration, persistence, or malicious prompt injection attempts were found; the prompts are well-constrained and aim for accurate, controlled LLM behavior.