Ai Intelligent Knowledge Qa

知识问答，FAQ + 智能检索 + AI 问答。

Security Scan

The skill's description matches a knowledge-QA product, but its runtime instructions tell an operator/agent to clone and execute unknown remote code (git + pip + python) while the skill metadata declares no required binaries or credentials — this mismatch and the implicit remote-code execution raise concern.

Purpose & Capability

The name/description (knowledge QA with GPT, vector DB, semantic search) is internally consistent with the SKILL.md features. However the declared registry metadata lists no required binaries or environment variables even though the instructions assume git, python, and likely GPT API keys — a mismatch between claimed capabilities and declared requirements.

Instruction Scope

SKILL.md instructs cloning https://github.com/openclaw-skills/ai-intelligent-knowledge-qa and running pip install -r requirements.txt and python app.py. Those commands fetch and execute arbitrary remote code and dependencies; the instructions do not mention required API keys (e.g., OpenAI) or other config, nor do they constrain what the cloned repo will do. For an instruction-only skill this is the primary risk surface.

Install Mechanism

There is no formal install spec in the registry; the doc tells the user/agent to git clone a GitHub repo and run pip install. While GitHub is a common host, cloning and installing without a pinned, reviewed release can execute arbitrary and unvetted code and introduce dependency-based risks.

Credentials

The skill declares no required environment variables or primary credential, yet its features include 'GPT integration' and 'vector DB' which typically require API keys/connection strings. The lack of declared credentials is a gap — the repo likely expects secrets but the skill metadata does not request or explain them.

Persistence & Privilege

The skill is not configured as always:true and is user-invocable only. It does not request system-level persistence in the registry metadata. The main persistence concern comes from the instructions (running a server), but that is external to the skill metadata and not an automatic privilege granted by the registry entry.

What to consider before installing

This skill's README tells you to clone and run code from a GitHub repo and install its Python dependencies — that can execute arbitrary code on your machine. Before installing: (1) inspect the referenced GitHub repository and its requirements.txt and app.py for malicious behavior, (2) verify the repo's author and check recent commits/releases, (3) run the code in an isolated sandbox/container, (4) expect to need API keys (OpenAI, vector DB) even though the skill metadata doesn't declare them, and (5) prefer skills that publish vetted releases or that explicitly declare required binaries and environment variables. If you cannot review the repository, avoid running these commands on production or sensitive hosts.

AI 智能知识问答系统

描述

知识问答，FAQ + 智能检索 + AI 问答。

功能

• FAQ 管理（问答库）
• 智能检索（语义搜索）
• AI 问答（GPT集成）
• 多渠道接入（Web/微信/API）
• 数据分析（问答统计）

定价

• 基础版：¥199/月（1000 问答/月）
• 专业版：¥999/月（10000 问答/月）
• 企业版：¥2999/月（无限问答）

适用场景

• 智能客服
• 知识管理
• 内部问答
• 产品支持

技术栈

• Python + FastAPI
• 向量数据库
• GPT 集成
• 语义搜索

安装

git clone https://github.com/openclaw-skills/ai-intelligent-knowledge-qa
cd ai-intelligent-knowledge-qa
pip install -r requirements.txt
python app.py

---

创建：2026-03-13 作者：OpenClaw Skills Team