Ai Intelligent Knowledge Qa

知识问答，FAQ + 智能检索 + AI 问答。

Security Scan

The skill's description claims GPT and vector DB integration but its instructions ask you to git-clone and run an external repo without declaring any required credentials or a formal install spec — this mismatch and the potential to execute arbitrary code make it suspicious.

Purpose & Capability

The SKILL.md advertises GPT integration, a vector DB, and multi-channel connectors (WeChat/API) but the skill declares no required environment variables, credentials, or config paths. Real-world operation would normally require API keys (e.g., OpenAI or other LLM provider) and DB connection strings, so the declared requirements do not match the described capabilities.

Instruction Scope

The runtime instructions tell the agent to run: git clone https://github.com/openclaw-skills/ai-intelligent-knowledge-qa; pip install -r requirements.txt; python app.py. Those steps fetch and execute external code, install dependencies, and run a server — operations that can read/write files, open network connections, and execute arbitrary code. The SKILL.md does not enumerate what files, env vars, or secrets the repo expects, nor does it limit what the cloned code may do.

Install Mechanism

There is no formal install spec in the registry, yet SKILL.md instructs cloning a GitHub repo and installing Python requirements. Installing and running an external repository at runtime is higher-risk than an instruction-only skill that uses only local tooling, because it pulls arbitrary third-party code onto the system without checksum, release pinning, or vetting.

Credentials

No environment variables or credentials are declared, despite features (GPT, vector DB, WeChat/API connectors) that normally require secrets and connection strings. The absence of declared secrets is disproportionate and makes the skill's resource needs unclear — either it won't work as advertised, or it expects secrets to be supplied ad hoc (risk of accidental credential exposure).

Persistence & Privilege

The skill does not request always:true and does not declare system-wide config changes. The only persistence risk is from following its own git/pip/python instructions (which would write files and install packages), but the skill metadata itself does not request elevated platform privileges.

Scan Findings in Context

[no_regex_findings] expected: The static scanner found nothing because this package is instruction-only with no code files; that's expected but provides no assurance. The SKILL.md itself includes commands to fetch and run external code, which the scanner could not evaluate.

What to consider before installing

This skill asks you to clone and run code from a GitHub repo but does not declare the API keys or DB connections it clearly needs. Before installing or running anything: (1) ask for the exact repository URL and a release tag/commit, then review the repository code (especially requirements.txt, app.py, and any startup scripts); (2) require the maintainer to document required environment variables and why they are needed (e.g., OPENAI_API_KEY, vector DB URL); (3) run the clone + pip install inside an isolated environment (container or sandbox) and do not use production credentials; (4) prefer an install method with checksums or official releases. If you cannot review the repo or get clear declarations of required secrets, avoid running it.

AI 智能知识问答系统

描述

知识问答，FAQ + 智能检索 + AI 问答。

功能

• FAQ 管理（问答库）
• 智能检索（语义搜索）
• AI 问答（GPT集成）
• 多渠道接入（Web/微信/API）
• 数据分析（问答统计）

定价

• 基础版：¥199/月（1000 问答/月）
• 专业版：¥999/月（10000 问答/月）
• 企业版：¥2999/月（无限问答）

适用场景

• 智能客服
• 知识管理
• 内部问答
• 产品支持

技术栈

• Python + FastAPI
• 向量数据库
• GPT 集成
• 语义搜索

安装

git clone https://github.com/openclaw-skills/ai-intelligent-knowledge-qa
cd ai-intelligent-knowledge-qa
pip install -r requirements.txt
python app.py

---

创建：2026-03-13 作者：OpenClaw Skills Team