2026-3-22dataset

Use for RAGFlow dataset tasks: create, list, inspect, update, or delete datasets; upload, list, update, or delete documents; start or stop parsing; check par...

Security Scan

The skill's code, instructions, and required environment variables align with its stated purpose (managing RAGFlow datasets/docs/parsing/search); nothing obvious or disproportionate is requested or installed.

Purpose & Capability

Name/description match the included scripts and env vars: the bundle implements dataset create/list/info/update/delete, document upload/list/update/delete, parsing control, status, search, and model listing. Required env vars (RAGFLOW_API_URL, RAGFLOW_API_KEY) and python3 are appropriate for interacting with a RAGFlow HTTP API.

Instruction Scope

SKILL.md instructs the agent to run the shipped scripts under scripts/ and to prefer --json, and the scripts perform only HTTP calls to the configured RAGFlow URL using the declared env vars. Scripts do not read unrelated system files or other environment variables, and guardrails (resolve IDs first, require explicit delete IDs) are present in policy text.

Install Mechanism

No install spec is provided (instruction-only for runtime usage); scripts are shipped with the skill and executed with python3. No remote downloads or archive extraction are performed by an installer.

Credentials

The only sensitive items requested are RAGFLOW_API_URL and RAGFLOW_API_KEY (primaryEnv), which are directly required to call the service the skill targets. The number and type of env vars are proportionate to the skill's functionality.

Persistence & Privilege

The skill does not request always: true and does not attempt to modify other skills or system-wide agent settings. It requires no persistent installation steps or special privileges beyond running the bundled scripts.

Assessment

This skill appears to do what it advertises: run the included Python scripts against a RAGFlow API. Before installing or enabling it, make sure RAGFLOW_API_URL points to a trusted RAGFlow server and provide only an API key you intend to allow for dataset/document operations. The skill will perform HTTP requests to that URL using the provided key, including endpoints that can list configured LLMs (list_models exposes api_base and other model metadata). The agent's SKILL.md asks you (the agent) to require explicit confirmation for deletes — verify that your agent actually prompts users for confirmation before destructive actions. If you need tighter control, restrict the API key's permissions (principle of least privilege) or use a read-only key for listing/status use cases.

RAGFlow Dataset And Retrieval

Use only the bundled scripts in scripts/. Prefer --json so returned fields can be relayed exactly. Follow reference.md for all user-facing output.

Use This Skill When

• the user wants to create, list, inspect, update, or delete RAGFlow datasets
• the user wants to upload, list, update, or delete documents in a dataset
• the user wants to start parsing, stop parsing, or check parse progress
• the user wants to retrieve chunks from one or more datasets
• the user wants to list configured RAGFlow models

Core Workflow

1. Resolve the target dataset or document IDs first.
2. Run the matching script from scripts/.
3. Use --json unless a script only needs a simple text response.
4. Return API fields exactly; do not guess missing details.

Common commands:

python3 scripts/datasets.py list --json
python3 scripts/datasets.py info DATASET_ID --json
python3 scripts/datasets.py create "Example Dataset" --description "Quarterly reports" --json
python3 scripts/update_dataset.py DATASET_ID --name "Updated Dataset" --json
python3 scripts/upload.py DATASET_ID /path/to/file.pdf --json
python3 scripts/upload.py list DATASET_ID --json
python3 scripts/update_document.py DATASET_ID DOC_ID --name "Updated Document" --json
python3 scripts/parse.py DATASET_ID DOC_ID1 [DOC_ID2 ...] --json
python3 scripts/stop_parse_documents.py DATASET_ID DOC_ID1 [DOC_ID2 ...] --json
python3 scripts/parse_status.py DATASET_ID --json
python3 scripts/search.py "query" --json
python3 scripts/search.py "query" DATASET_ID --json
python3 scripts/search.py --dataset-ids DATASET_ID1,DATASET_ID2 --doc-ids DOC_ID1,DOC_ID2 "query" --json
python3 scripts/search.py --retrieval-test --kb-id DATASET_ID "query" --json
python3 scripts/list_models.py --json

Guardrails

• For any delete action, list the exact items first and require explicit user confirmation before executing.
• Delete only by explicit dataset IDs or document IDs. If the user gives names or fuzzy descriptions, resolve IDs first.
• Upload does not start parsing. Start parsing only when the user asks for it.
• parse.py returns immediately after the start request; use parse_status.py for progress.
• For progress requests, use parse_status.py on the most specific scope available:
  • dataset specified: inspect that dataset
  • document IDs specified: pass --doc-ids
  • no dataset specified: list datasets first, then aggregate status across datasets
• If a parse status result includes progress_msg, surface it directly. For FAIL, treat it as the primary error detail.
• Use --retrieval-test only for single-dataset debugging or when the user explicitly asks for that endpoint.

Output Rules

• Follow reference.md.
• Use tables for 3+ items when possible.
• Preserve api_error, error, message, and related fields exactly as returned.
• Never fabricate progress percentages or inferred causes.