Skill Preflight

Automatically inject relevant skills and protocols into agent context using local embeddings. Free, no API calls — uses Ollama with nomic-embed-text.

This plugin is internally consistent and implements what it claims, but review these before enabling: (1) Keep ollamaBaseUrl set to localhost/127.0.0.1/::1 unless you trust the remote host — otherwise your prompts and all indexed docs (including any embedded secrets or API keys in markdown) will be transmitted off-host. (2) Audit your skills/ memory/protocol markdown and remove any secrets or credentials before allowing the plugin to index them, or restrict protocolDirs/skillsDirs to safe paths. (3) Because the repository source is 'unknown' in the metadata provided, review the dist/index.js (full file) yourself or run the plugin in a sandbox to confirm behavior matches expectations. (4) Tune minScore, maxDocLines, and pinnedDocs to reduce accidental injection of large or sensitive docs. (5) If you need higher assurance, run Ollama locally and validate network traffic to ensure embeddings never leave your machine.

Type: OpenClaw Skill Name: skill-preflight Version: 1.0.5 The plugin implements a RAG (Retrieval-Augmented Generation) system that reads local markdown files from the workspace and sends their content, along with user prompts, to a configurable Ollama API endpoint for embedding (dist/index.js). While the documentation (README.md) and the code itself include explicit warnings and runtime logs regarding the privacy risks of using a non-local 'ollamaBaseUrl', the capability to read arbitrary files and transmit them to a network endpoint constitutes a high-risk behavior that could be leveraged for data exfiltration if misconfigured.