ClawHub

Dify Knowledge Base Search

v1.1.1

Search Dify Knowledge Base (Dataset) to get accurate context for RAG-enhanced answers.

⭐ 0· 1.1k·2 current·2 all-time
by@xiaowenzhou
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the actual behavior: both scripts list datasets and call Dify endpoints (/v1/datasets and /v1/datasets/{id}/retrieve). The required env vars (DIFY_API_KEY, DIFY_BASE_URL) are exactly what the code uses.
✓
Instruction Scope
SKILL.md and the scripts limit actions to constructing HTTP requests to the Dify API, parsing responses, and printing JSON. The scripts only read the two declared environment variables and stdin parameters; they do not access other system files, credentials, or external endpoints.
ℹ
Install Mechanism
Dependencies are minimal (python3 runtime + requests). SKILL.md instructs pip3 install requests and the code runs with python3. The registry install spec oddly labels these as kind: 'node' (for python3 and requests), which is inconsistent but appears to be a metadata/packaging quirk rather than malicious behavior. Verify that the platform's installer will run pip3 (not fetch arbitrary remote code).
✓
Credentials
Only DIFY_API_KEY and DIFY_BASE_URL are required and used. This is proportionate for a Dify integration. No unrelated secrets or system credentials are requested.
✓
Persistence & Privilege
always:false and standard tool invocation. The skill does not request permanent presence or modify other agents' configs. Autonomous invocation is allowed (platform default) but not combined with broad privileges.
Assessment
This skill appears to do exactly what it says: query a Dify instance using DIFY_BASE_URL and DIFY_API_KEY. Before installing: 1) Ensure the DIFY_API_KEY you provide has least privilege (restrict access/permissions and rotate keys regularly). 2) Confirm DIFY_BASE_URL points to a trusted, TLS-enabled endpoint (https). 3) Double-check the platform's install step because the registry metadata shows an unexpected 'node' kind for Python packages — ensure the installer will use your system's python3 and pip3 and will not fetch arbitrary binaries. 4) Do not commit API keys into source control and consider running the skill in an environment with restricted network access if you want to limit blast radius.

Like a lobster shell, security has layers — review code before you run it.

latestvk977ffmcfeh4028pwwd96gx3wn80sr49

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvDIFY_API_KEY, DIFY_BASE_URL

Install

Node
Bins: python3
npm i -g python3
Install Python requests librarynpm i -g requests

Comments