Semantic Vector Store

提供文本向量化、持久化存储及基于余弦相似度的语义搜索，支持增量索引和多后端适配。

This skill appears to implement a local vector store (SQLite + optional FAISS) and mostly does what it claims, but exercise caution: 1) There is no verified source/homepage — only run it if you trust the publisher or after reviewing the code. 2) Dependencies (sentence-transformers, faiss, numpy) are not declared in the registry; install them in a controlled virtual environment. 3) The implementation uses pickle for persisted data and ID maps — do not point the skill at untrusted DB or index files (pickle deserialization can run arbitrary code). 4) SKILL.md advertises multi-backend support and environment variables, but the code primarily supports a local SQLite+FAISS path — verify the connectors you need are actually implemented. 5) If you decide to install, run it inside an isolated environment (container/VM) until you confirm behavior; consider reviewing the rest of the code (the truncated portion) to ensure there are no network callbacks or hidden endpoints.

Type: OpenClaw Skill Name: semantic-vector-store Version: 0.1.0 The skill implements a semantic vector store using SQLite and FAISS, but it contains a significant security vulnerability in `scripts/semantic_vector_store.py` due to the use of the `pickle` module for serializing embeddings and ID mappings. Loading data via `pickle.loads()` and `pickle.load()` is inherently insecure and can lead to Remote Code Execution (RCE) if the local database or index files are tampered with. While the code logic appears to align with its stated purpose and no evidence of intentional malice or data exfiltration was found, the use of insecure serialization for persistent storage is a high-risk practice.