by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, instructions, and requirements match its stated purpose (calling a LibRAG recall endpoint using a local Python helper); nothing requested or installed is disproportionate.
评估建议
This skill is a straightforward helper for calling a LibRAG recall endpoint. Before installing: (1) ensure base_url points to the intended LibRAG instance (default is localhost); (2) put the API key in config.json and protect that file (restrict filesystem permissions, don't check it into source control); (3) be aware the tool prints the config path and server responses verbatim — avoid passing secrets or private data in requests if you don't want them echoed; (4) verify the endpoint is trusted ...详细分析 ▾
✓ 用途与能力
Name/description say it calls LibRAG recall API. The bundle contains a Python script that calls a /librag/knowbase/recall endpoint and a config.json with base_url, api_key, kb_id, etc. Requiring a Python runtime and a config file is consistent with the stated purpose.
ℹ 指令范围
SKILL.md instructs the agent to run the included Python script with a config.json and question. The script reads config.json, constructs a GET request with Authorization: Bearer <api_key>, and prints JSON containing request/response and a summary. This is within scope. Minor note: the script prints the config file path and server response verbatim (including any echoed data). Although the script itself does not print the API key, server responses could theoretically echo sensitive fields—so be careful with what you send/return.
✓ 安装机制
No install spec; this is instruction-only plus an included Python script. Nothing is downloaded or written to disk by the skill beyond reading the provided config.json and running the script, which is low-risk and proportional.
✓ 凭证需求
The skill does not request environment variables or unrelated credentials. It expects an API key and endpoint in config.json, which is appropriate for an API client. Storing the API key in config.json is a design choice — users should protect that file (permissions) and avoid committing it to source control.
✓ 持久化与权限
always:false and default autonomous invocation are set. The skill does not attempt to modify other skills, system settings, or persist new credentials. It only reads the local config and performs a network call to the configured base_url.
⚠ config.json:2
Install source points to URL shortener or raw IP.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/10
- Initial release of librag-knowledge-recall skill for Chinese knowledge base recall using local LibRAG API. - Supports knowledge base retrieval, evidence extraction, and source location based on specified trigger phrases. - Uses Python script with settings from config.json; allows command-line overrides for key parameters. - Returns structured JSON with key results and request details. - Built-in error handling for missing config, authentication, and missing knowledge base cases.
● 无害
安装命令 点击复制
官方npx clawhub@latest install librag-knowledge-recall
镜像加速npx clawhub@latest install librag-knowledge-recall --registry https://cn.clawhub-mirror.com
技能文档
# LibRAG 中文知识库召回 优先使用附带脚本调用 LibRAG，不要手写 HTTP 请求。
触发语义
遇到下列表达时优先使用本 Skill：- “去知识库里查一下”
- “做一下数据召回”
- “从 LibRAG 找相关段落”
- “把出处和原文召回出来”
- “根据知识库检索证据”
- “从文档中找到答案”
输入
必需输入：question：用户要检索的问题或条件。
config.json：
base_url：LibRAG 服务地址。api_key：与目标知识库绑定的 API Key。kb_id：默认知识库 ID。recall_mode：默认召回模式。vector_top_k：向量召回 top-k。fulltext_top_k：全文召回 top-k。return_tree：是否返回树形结构。has_source_text：是否包含原文。has_score：是否保留分数字段。filter_effective：是否过滤无效结果。reasoning_enhance：是否启用推理增强。score_threshold：打分过滤阈值。
config.json：
kb_id：覆盖config.json里的默认知识库 ID。recall_mode：reasoning、hybrid、vector，默认hybrid。vector_top_k：默认20。fulltext_top_k：默认20。return_tree：默认true。has_source_text：默认true。has_score：默认true。score_threshold：默认0，作为打分过滤的分数阈值。filter_effective：默认true。reasoning_enhance：默认true。
执行
默认使用config.json 中的知识库：
``bash
python {baseDir}/scripts/recall.py --config {baseDir}/config.json --question "<问题>"
`
需要覆盖知识库时：
`bash
python {baseDir}/scripts/recall.py --config {baseDir}/config.json --kb-id 12 --question "这个产品的违约金标准是什么？"
`
输出
默认直接返回脚本输出 JSON。
关键字段：
request
response.msg
response.data
summary.item_count
summary.result_shape
约束
- 缺少
config.json，或其中的 base_url、api_key、kb_id，或缺少 question 时直接失败。
默认使用非流式调用。
默认使用 return_tree=true，只有明确要求平铺段落结果时才改成 false。
不要输出完整 API Key。
若返回 401 或 403，明确提示密钥无效或没有该知识库权限。
若返回 404`，明确提示知识库不存在。
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制