知识网格 / Knowledge Mesh

v1.0.0

知识网格 — 跨平台知识搜索聚合器,统一搜索 GitHub、Stack Overflow、Discord、Confluence、Notion、Slack、百度、Obsidian,支持自学习排序

0· 83·0 current·0 all-time
byJun Zhang@hanjing5024064
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (cross-platform search + local indexing + monitoring) matches the declared optional environment variables and the included scripts (source_searcher, index_builder, obsidian_connector, learning_engine, etc.). Sensitive tokens (GitHub, Slack, Notion, Discord, Confluence, Baidu) are expected for those integrations.
Instruction Scope
SKILL.md instructs the agent to run the included Python scripts which read environment variables and local paths and write to a local data directory. That scope aligns with the stated purpose. It will access local files (Obsidian vault, indexed paths) and persist usage/learning data locally; the README claims 'no data passes through third‑party servers' — this appears plausible but should be verified by reviewing source_searcher adapters for any hidden relay endpoints (some files were truncated in the package listing).
Install Mechanism
No install spec or external downloads; the skill is instruction+bundled scripts. No evidence of remote installers or arbitrary archive extraction in the provided manifest.
Credentials
The skill requests many sensitive tokens (GitHub, Discord bot, Confluence, Notion, Slack, Baidu API key) but marks them optional and they are proportionate to the claimed integrations. It also reads KM_OBSIDIAN_VAULT_PATH and KM_DATA_DIR for local indexing. Because these grant access to private data, users should supply minimal-scoped credentials and prefer read-only tokens where possible.
Persistence & Privilege
always:false and no claims to modify other skills or system-wide agent settings. The skill persists data under a dedicated local directory (KM_DATA_DIR or ~/.openclaw-bdi/knowledge-mesh), which is reasonable for indexing/learning features.
Assessment
This skill appears coherent for a multi-source search/aggregation tool: it uses the tokens you would expect and stores data locally under ~/.openclaw-bdi/knowledge-mesh (or KM_DATA_DIR). Before installing, review these points: 1) Inspect scripts/source_searcher.py (and its adapters) to confirm it calls only official platform APIs and has no hardcoded third‑party relay endpoints; truncated files in the package mean I couldn't fully verify that here. 2) Provide least‑privilege credentials (read-only tokens, limited scopes) for GitHub/Confluence/Notion/Slack/Discord and avoid using highly privileged personal tokens. 3) If you will index local notes, set KM_OBSIDIAN_VAULT_PATH and KM_DATA_DIR to a controlled location and consider running the skill in an isolated environment. 4) If the README's privacy claim ('no data passes through third‑party server') is important to you, confirm network behavior by reviewing the source_searcher adapters or running in a network‑monitored sandbox. If you want, I can scan the remaining truncated files (source_searcher, index_builder, others) for any external endpoints or suspicious code — that would raise my confidence to high.

Like a lobster shell, security has layers — review code before you run it.

aggregatorvk974mvnp7bvxn3m3p41wnb10w18367xvcross-platformvk974mvnp7bvxn3m3p41wnb10w18367xvknowledge-managementvk974mvnp7bvxn3m3p41wnb10w18367xvlatestvk974mvnp7bvxn3m3p41wnb10w18367xvobsidianvk974mvnp7bvxn3m3p41wnb10w18367xvsearchvk974mvnp7bvxn3m3p41wnb10w18367xv

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments