Google Drive based RAG

Search, retrieve, and chat with documents securely stored in a designated Google Drive folder using semantic vector search (RAG RAG). Use when: (1) a user as...

Security Scan

The skill's code, install steps, and required environment variables are consistent with its stated purpose (indexing a Google Drive folder and using Gemini for embeddings/OCR); no evidence of covert or unrelated behavior was found, though it will transmit user file contents to Google's APIs and write files into the workspace so users should be mindful of sensitive data and authentication setup.

Purpose & Capability

Name/description ask to index a Google Drive folder and provide RAG search; required binaries (node, npm, gws), env vars (GEMINI_API_KEY, FILECHAT_DRIVE_FOLDER_ID), the provided code (sync.js, query.js, image_parse.js), and dependencies (Google generative client, pdf-parse, chromadb) all directly support that purpose.

Instruction Scope

Instructions require creating ./skills/filechat/.env and running sync/query which will: connect to Google Drive via the Google Workspace CLI, download files into the workspace, extract text (including OCR via Gemini), call Gemini embedding endpoints, and save a local vector DB and temporary files. These actions match the described functionality but they do involve downloading user files and sending their contents to external APIs (Google). The skill also writes files into /workspace and uses MEDIA:/workspace/... to send files back to the user.

Install Mechanism

Install steps use npm and install @googleworkspace/cli and the skill's npm dependencies. No arbitrary URL downloads or extract-from-unknown-host steps were found. (One minor oddity: the code invokes the CLI with 'npx @googleworkspace/cli' even though the install spec provides a gws binary.)

Credentials

Requested env vars (GEMINI_API_KEY, FILECHAT_DRIVE_FOLDER_ID) are appropriate to embedding/OCR and selecting the Drive folder. No unrelated secrets or multiple unrelated credentials are requested. Note: the skill assumes Google Workspace CLI (gws) is configured for Drive access (OAuth/credentials are external to the skill), and it sets SSL_CERT_FILE=/workspace/cacert.pem in exec calls (assumes that file exists).

Persistence & Privilege

The skill is not always-on and does not modify other skills or global agent settings. It stores a local DB file (vector_db.json) and writes temporary/downloaded files into the workspace, which is expected for its function but is a persistence to be aware of.

Assessment

This skill appears to do what it says: it will recursively download files from the specified Google Drive folder, extract text (including OCR of images), send content to Google's Gemini APIs to compute embeddings and OCR, and store a local vector DB and temporary files in the workspace. Before installing or running it, consider: 1) Don’t supply the GEMINI_API_KEY or index a Drive folder containing highly sensitive data unless you trust sending that data to Google’s APIs. Embeddings and images are transmitted to external services. 2) The skill assumes the Google Workspace CLI (gws) is configured for Drive access (OAuth tokens/credentials are not requested by the skill itself); ensure gws is authenticated appropriately and that you understand which Google account will be accessed. 3) The sync process will write temporary files (./skills/filechat/filechat_<id> and /workspace/discharge.pdf) and a persistent vector_db.json into the workspace—run in an isolated workspace if you are concerned. 4) The code calls npx for the Google CLI which may attempt to fetch packages at runtime if not installed; to avoid runtime network fetches, run the provided install steps and verify gws is present. If you are uncomfortable with any of the above (especially transmitting documents to external APIs), do not install or run this skill, or run it in a sandboxed environment and review logs/output first.

FileChat Skill

Your personal RAG (Retrieval-Augmented Generation) document library backed by Google Drive.

Setup & Bootstrap

If the user asks to use FileChat or asks a question about their files, FIRST verify that the required environment variables are set in /workspace/skills/filechat/.env:

1. GEMINI_API_KEY (For the embedding model text-embedding-004)
2. FILECHAT_DRIVE_FOLDER_ID (The root Google Drive folder ID to index)

If they are missing, STOP and ask the user to provide them. (To find the folder ID, they can look at the URL of the folder in Google Drive: https://drive.google.com/drive/folders/<FOLDER_ID>)

Create the .env file like this:

echo "GEMINI_API_KEY=your_key_here" > ./skills/filechat/.env
echo "FILECHAT_DRIVE_FOLDER_ID=your_folder_id_here" >> ./skills/filechat/.env

How to Sync the Library

When the user asks to "sync", "flush", or "update" their FileChat library, you must run the ingestion script. This connects to Google Drive, downloads all new/changed files (including PDFs, resolving shortcuts, and traversing sub-folders), chunks the text, gets embeddings, and saves them to a local ChromaDB.

cd ./skills/filechat && node sync.js

(Warning: The first sync may take a few minutes depending on the folder size.)

How to Answer User Questions (RAG)

When a user asks a question about the contents of their documents (e.g., "What does my medical discharge say?"), you MUST query the local ChromaDB vector store to fetch the relevant text chunks.

cd ./skills/filechat && node query.js "What does my medical discharge say?"

The output will give you the most relevant text snippets, the original file names, and the Google Drive File IDs. Use the text snippets to formulate a comprehensive answer for the user. Always cite the file name you are referencing.

How to Retrieve and Send a Physical File

If the user asks for the actual file (e.g., "Send me the discharge PDF"), first find the File ID using the query script (if you don't already know it).

Then, use the gws CLI to download the file into your workspace:

gws drive files get --params '{"fileId": "<FILE_ID>", "alt": "media"}' > /workspace/discharge.pdf

Then, reply to the user using the OpenClaw media attachment syntax: MEDIA:/workspace/discharge.pdf to send the physical file directly to their chat window.

How to Store a New File for the User

If the user uploads a file and asks you to "store" or "save" it:

1. Upload it to their FileChat Google Drive folder using gws:

   gws drive files create \
     --json '{"name": "filename.pdf", "parents": ["<FILECHAT_DRIVE_FOLDER_ID>"]}' \
     --upload /path/to/uploaded/file.pdf
   

2. Trigger the sync process so the new file is immediately readable by the vector database:

   cd ./skills/filechat && node sync.js