Vector Store Shootout

8 vector store implementations behind a common interface — numpy, lancedb, qdrant, pgvector, weaviate, weaviate_hybrid, milvus, lightrag. Use when evaluating...

This skill appears to implement the vector stores it claims, but there are multiple practical inconsistencies you should address before installing or running it: - Dependencies: The code requires many Python packages (requests, numpy, networkx, lancedb, qdrant_client, psycopg2/pymilvus/pyarrow/weaviate-client, etc.) but the skill only declares python3. Don't run it on a production host without creating a pinned virtual environment (venv/conda) and installing and auditing those packages first. - Network vs local: The SKILL metadata implies no outbound networking, but the code calls embedding endpoints (default: local Ollama at http://localhost:11434) and optionally OpenAI (api.openai.com). If you want purely local operation, run an Ollama instance on localhost and avoid supplying OpenAI keys. If you supply an OpenAI key or use remote DB backends, data (the texts you index/query) will be sent to those services. - Secrets: The skill doesn't declare required env vars, yet it will accept and use an OpenAI API key if given. Only provide credentials if you trust the code and run it in an isolated environment; do not pass secrets you wouldn't want used for remote embedding/exfiltration. - Resource effects: Backends create temporary files, DB tables, and collections and delete them on cleanup; verify these operations are acceptable in your environment (especially if you point to an existing Postgres instance or other shared service). - Safety steps: Run the skill in a disposable VM or container first, pin dependency versions, inspect network traffic to ensure embeddings are sent to endpoints you expect, and consider providing a local embed_fn (test injection) to avoid network calls during evaluation. If you need a complete dependency/install spec and clearer network/credential documentation, request it from the publisher before using in production.

Type: OpenClaw Skill Name: vector-store-shootout Version: 1.0.0 The skill bundle implements various vector store backends but contains a significant security vulnerability and a metadata discrepancy. Specifically, `scripts/pgvector_store.py` is vulnerable to SQL injection because it uses f-strings to interpolate the `table_name` directly into SQL queries. Furthermore, the `SKILL.md` file incorrectly claims no outbound network access (`network: outbound: false`), whereas multiple files (e.g., `scripts/numpy_store.py`, `scripts/weaviate_store.py`) contain logic to send data to the external OpenAI API (`api.openai.com`) for embedding generation.