RAG Search

• Analyzed: May 12, 2026, 3:34 AM
• Findings: 1
• Version: 0.1.1
• Hash: aaac5d8cd59de94703d52ac82261aea8cfba4b23d33b244b9ede8b071ecdaff5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its reliance on hardcoded absolute paths within the `/root` directory for importing modules and accessing a database file. Specifically, `handler.py` uses `sys.path.insert(0, '/root/.openclaw/workspace/rag_system/scripts')` and accesses `db_path = "/root/.openclaw/workspace/rag_system/data/vectors.db"`. While this file access is plausibly needed for the stated RAG search purpose, it grants the skill implicit broad permissions to system-level components and data, posing a supply chain risk if the external RAG system components are compromised. There is no clear evidence of intentional malicious behavior like data exfiltration or unauthorized command execution within the provided skill bundle itself.