Raon OS

AI-powered startup companion for Korean founders. Evaluate business plans, match government funding programs (TIPS/DeepTech/Global TIPS), connect with 3,972+...

This skill appears to do what it says (business-plan evaluation, government program crawlers, RAG, local REST API). Before installing or running it, consider: 1) Secrets: it recommends storing LLM API keys in ~/.openclaw/.env — ensure that file is protected (chmod 600) or keep keys in a secure vault; 2) Local server exposure: by default it runs an HTTP server (port 8400) and includes instructions for ngrok and installing a service — do not expose the server to the public without reviewing server.py, admin endpoints, and adding proper firewall/reverse-proxy protections; 3) Persistence: the skill writes data under eval_data/ and history files and may append to JSONL files; if you are concerned about sensitive PDFs or PII, run it in an isolated environment or container and inspect parse/evaluate scripts first; 4) Review install-service.sh and any systemd/service scripts before using them; 5) Allowed-domain fetch: the crawlers fetch public government sites and the code documents an allowlist for realtime fetches — if you plan to expose the server to third parties, verify the is_allowed_url() logic in server/rag_pipeline to ensure arbitrary outbound fetches are blocked; 6) Test code note: the repo includes test fixtures (conftest.py) that mock authentication for tests — this is normal for tests but ensure you are not running the test harness in production mode. If any of these behaviors are unacceptable, run the skill in a sandbox or review/modify the code before use.

Type: OpenClaw Skill Name: raon-os Version: 0.7.28 The raon-os skill is a comprehensive startup assistant designed to evaluate business plans, match government funding, and provide valuation estimates. It implements a RAG (Retrieval-Augmented Generation) pipeline using various LLM providers (Gemini, OpenAI, OpenRouter) and includes a local HTTP API server (server.py) to power a web widget. Security-conscious features are present, such as SSRF protection via domain whitelisting, input sanitization to mitigate prompt injection, and restricting administrative API endpoints to localhost. The network activities, including crawling government sites and communicating with LLM APIs, are transparently documented and aligned with the skill's stated purpose.