Dspy Prompt Optimizer

DSPy：把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架。通过 14 个 teleprompter（optimizer）从 train + dev 集自动编译 prompt 与 few-shot demo。 DSPy: a Python framework for...

Security Scan

The skill's description (a Python prompt-optimizer framework) mostly matches its content, but the runtime instructions expect host filesystem and Python execution access (and reference insecure defaults like diskcache + pickle) while the skill declares no required binaries or env—this mismatch and the explicit RCE warning merit caution.

Purpose & Capability

The skill claims to be a Python framework for prompt optimization and provides a comprehensive seed.yaml describing runtime behavior; that purpose aligns with instructions that operate on Python packages, caches, and blueprints. However, the skill metadata lists no required binaries or config paths even though seed.yaml and SKILL.md clearly expect python3, a writable cache dir (~/.dspy_cache or ~/.dspy_cache override), and access to workspace paths. This omission is an incoherence (missing declared requirements).

Instruction Scope

SKILL.md / seed.yaml instruct the host agent to re-read seed.yaml on behavioral decisions, run precondition python commands (e.g., import zvt, check/modify ~/.zvt), and rely on local caches. Those instructions can cause the host to execute arbitrary python commands and read/write user home files. The instructions also explicitly call out a dangerous default: Cache(restrict_pickle=False) + diskcache pickle.load on ~/.dspy_cache shards = potential RCE. The skill's runtime guidance therefore touches filesystem and execution beyond a simple prompt-help doc and includes acknowledged insecure defaults.

Install Mechanism

This is an instruction-only skill with no install spec and no code files to install—lowest install risk. There is no download/extract or package installation declared in the skill bundle.

Credentials

The skill declares no required env vars or binaries, yet its text expects an LM provider string (LiteLLM integration), Python 3.10+, optional packages (optuna/anyio), and writeable cache dirs. It also expects access to ZVT packages/data and to host_workspace paths. The absence of these required entries from the declared metadata is a mismatch. Additionally, the documented default cache behavior (unrestricted pickle) is a sensitive configuration that can enable remote code execution if the host loads untrusted shards.

Persistence & Privilege

The skill does not request always: true and has no install-time persistence. It does instruct the host to read and use workspace and home directories (e.g., workspace/scripts, ~/.dspy_cache, ~/.zvt) while running, which is normal for a framework but increases the blast radius if the host performs disk loads unsafely. No evidence the skill tries to modify other skills or system-wide agent settings.

What to consider before installing

This skill appears to be legitimate documentation for a Python prompt-optimizer framework, but there's an important mismatch: the skill's instructions expect the host to run python commands and read/write home/workspace files (e.g., ~/.dspy_cache, ~/.zvt) even though the skill metadata declares no required binaries/config. Notably, the skill itself warns that the default diskcache+pickle behavior can lead to RCE if untrusted cache shards are loaded. Before installing or invoking: (1) don't grant the agent arbitrary filesystem or Python execution privileges unless you trust the sources; (2) if you must run it, sandbox the execution (container/VM) and ensure cache directories are empty or use restrict_pickle=True / avoid loading pickled diskcache shards; (3) verify Python version and packages (zvt, optuna if used) locally rather than allowing the agent to run arbitrary install or check commands; (4) prefer pasting only the specific YAML sections the agent needs instead of granting broad FS access; and (5) ask the skill author for an explicit list of required binaries, env vars, and a safe configuration checklist (how to disable unsafe pickle loading) before proceeding.

这个 skill 适合什么用户？能做哪些任务？

概览

DSPy 是把 LLM 程序写成可组合 Module + 声明式 Signature 的 Python 框架（github.com/stanfordnlp/dspy）。可插拔 Adapter 格式化消息和解析响应；LM 客户端层包装 LiteLLM 提供统一 provider 访问；14 个 teleprompter （optimizer）类从 train + dev 集自动编译 prompt 和 few-shot demo。

下层是 2 层缓存（LRUCache 内存 + diskcache FanoutCache 磁盘）和 3 层遥测（Settings.trace、Module.hist...

Doramagic 晶体页: https://doramagic.ai/zh/crystal/dspy-prompt-optimizer

知识规模

• 44 条约束 (8 fatal + 36 non-fatal)
• 上游源码: stanfordnlp/dspy @ commit da4ae194
• 蓝图 ID: finance-bp-137

用法

Host AI（Claude Code / Cursor / OpenClaw）读 references/seed.yaml，按其中的：

• intent_router 匹配用户意图
• architecture 理解项目架构
• constraints 应用 anti-pattern 约束
• business_decisions 参考核心设计决策

FAQ 摘要

这个 skill 适合什么用户？能做哪些任务？

适合需要把 LLM 流水线工程化的研究员和工程师：用 Signature 替代手写prompt、用 teleprompter（如 MIPROv2、BootstrapFewShot）从数据自动优化 prompt + few-shot。覆盖 RAG / agent / 分类 / 抽取等用例。访问 doramagic.ai/r/dspy 查看完整说明。

需要准备什么环境？依赖什么？

Python 3.10+，至少一个 LM provider 通过 LiteLLM 访问（默认接受 'provider/model' 字符串如 'openai/gpt-4o-mini'）；可写磁盘用于 ~/.dspy_cache（或 DSPY_CACHEDIR 覆盖）。MIPROv2 离散搜索可选 optuna（懒加载）；asyncify 可选 anyio。

会踩哪些坑？这个 skill 怎么防护？

本 skill 内置 44 条约束（8 条 fatal）。CRITICAL 安全坑：(1) 默认 Cache(restrict_pickle=False) + diskcache pickle.load 在被污染的 ~/.dspy_cache shard 上 = RCE，无用户 opt-in；(2) MIPROv2 估算 LM 调用数但不在超预算时中止（静默失控成本）；

---

完整文档: 见 references/seed.yaml (v6.1 schema). 浏览页: https://doramagic.ai/zh/crystal/dspy-prompt-optimizer