Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Llama Index Rag

v0.1.0

LlamaIndex:把任意文档变 LLM 可查询知识的 Python 框架。4 大支柱(Index/Retriever/QueryEngine/Synthesizer)+ 52 条 anti-pattern 约束(5 fatal)。 LlamaIndex: a Python framework that tur...

0· 20·0 current·0 all-time
byTang Weigang@tangweigang-jpg

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tangweigang-jpg/llama-index-rag.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Llama Index Rag" (tangweigang-jpg/llama-index-rag) from ClawHub.
Skill page: https://clawhub.ai/tangweigang-jpg/llama-index-rag
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install tangweigang-jpg/llama-index-rag

ClawHub CLI

Package manager switcher

npx clawhub@latest install llama-index-rag
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The skill advertises LlamaIndex RAG guidance and provides a compiled blueprint (finance-bp-135). The heavy finance/ZVT content and backtest preconditions are consistent with the included seed.yaml and human_summary (this is a domain-specific LlamaIndex/RAG crystal). There is no unexpected request for unrelated credentials or binaries.
Instruction Scope
Runtime instructions require the host AI to reload and read references/seed.yaml, run precondition checks (Python commands that verify zvt installation, data directories, and write permissions), and enforce disclosure/traceback rules. These actions involve reading skill bundle files and potentially checking the host filesystem (e.g., for LATEST.yaml or ZVT_HOME). This is in-scope for a blueprint that performs local backtests, but users should expect the skill to read local files and run local Python checks.
Install Mechanism
No install spec and no code files to execute; the skill is instruction-only. This minimizes install-time risk (nothing is downloaded or written by the skill itself).
Credentials
The skill does not declare or require environment variables or credentials. SKILL.md mentions Python 3.9+ and 'an LLM provider / embedding provider (default implicit OpenAI)' as runtime expectations but does not request OpenAI keys. This is a documentation/assumption mismatch (it may expect provider access at runtime), not an overt credential exfiltration request.
Persistence & Privilege
always is false and autonomous invocation is allowed (platform default). The skill does not ask to persist or modify other skills or global agent configuration. It references host workspace paths for scripts/skills/trace, which is reasonable for a blueprint that expects to write traces, but it does not itself include an install step that would create persistent binaries.
Assessment
This is an instruction-only, domain-specific LlamaIndex/RAG blueprint (finance-focused). Before installing or invoking: (1) review references/seed.yaml and human_summary to confirm it targets the workflows you want (it expects ZVT and local finance data); (2) expect the host to run the listed Python precondition checks (which probe for zvt, data directories, and write permissions) and to attempt to read local files like LATEST.yaml — run in a test environment if you are uncertain; (3) note the SKILL.md mentions default OpenAI providers but does not request API keys — be cautious about supplying credentials if the agent later asks for them; (4) if you do not want the agent to access local files or run python checks, do not enable or invoke this skill. Overall the skill is internally consistent with its stated purpose, but it will interact with local tooling and data, so review included seed.yaml and preconditions before use.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Primary envknowledge
aivk972fgjz3ga2vwxczg0v4nq7qh85gz30datavk972fgjz3ga2vwxczg0v4nq7qh85gz30latestvk972fgjz3ga2vwxczg0v4nq7qh85gz30mlvk972fgjz3ga2vwxczg0v4nq7qh85gz30
20downloads
0stars
1versions
Updated 6h ago
v0.1.0
MIT-0

这个 skill 适合什么用户?能做哪些任务?

概览

LlamaIndex 是把任意文档变成 LLM 可查询知识的 Python 框架(github.com/run-llama/llama_index)。四大支柱(Index / Retriever / QueryEngine / ResponseSynthesizer)配置化检索-合成循环;Ingestion pipeline 处理 Document → Node → Embedding → Index 转换,带 content-hash 缓存;workflow / agent 子模块(FunctionAgent / ReActAgent / CodeActAgent / multi-agent...

Doramagic 晶体页: https://doramagic.ai/zh/crystal/llama-index-rag

知识规模

  • 52 条约束 (5 fatal + 47 non-fatal)
  • 上游源码: run-llama/llama_index @ commit 0a6c90bf
  • 蓝图 ID: finance-bp-135

用法

Host AI(Claude Code / Cursor / OpenClaw)读 references/seed.yaml,按其中的:

  • intent_router 匹配用户意图
  • architecture 理解项目架构
  • constraints 应用 anti-pattern 约束
  • business_decisions 参考核心设计决策

FAQ 摘要

这个 skill 适合什么用户?能做哪些任务?

适合做企业知识库、文档问答、RAG 应用的工程师:从 PDF / Markdown / 网页等异构文档构建索引,结合 retrieve-then-synthesize 给 LLM 提供外部知识。覆盖 FunctionAgent / ReActAgent / CodeActAgent 等 agent 范式。访问 doramagic.ai/r/llama-index 查看完整用例。

需要准备什么环境?依赖什么?

Python 3.9+,至少一个 LLM provider(默认隐式 OpenAI gpt-3.5-turbo)和一个 embedding provider(默认隐式 OpenAI text-embedding-ada-002 → 1536 维)。默认用内存 SimpleVectorStore,持久化需安装对应集成包。

会踩哪些坑?这个 skill 怎么防护?

本 skill 内置 52 条约束(5 条 fatal)。典型踩坑:(1) ServiceContext 已硬删除(不是 deprecated),3 个入口直接 raise ValueError;(2) SentenceSplitter chunk_overlap 默认 200(与文档常引用的 constants.DEFAULT_CHUNK_OVERLAP=20 不一致);


完整文档: 见 references/seed.yaml (v6.1 schema). 浏览页: https://doramagic.ai/zh/crystal/llama-index-rag

Comments

Loading comments...