ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      tangepier-crypto

      Safety Report

      Taizi Knowledge Base

      @tangepier-crypto

      个人知识库 - 融合向量检索、实体关系、笔记管理

      121Downloads
      0Installs
      1Stars
      1Versions

      Security Analysis

      medium confidence
      Suspicious0.08 risk

      The SKILL.md claims a local personal knowledge-base but instructs running a specific Python script and touching user home directories without providing the script, required binaries, or clear configuration — the instructions and declared requirements are inconsistent.

      Mar 26, 20261 files4 concerns
      Purpose & Capabilityconcern

      The skill describes a personal knowledge base (vector search, entities, notes) but declares no required binaries or files while the instructions explicitly call a Python script (vector_kb.py) at a hard-coded path. That script is not included and no Python requirement is declared, so the claimed capability cannot be realized as described.

      Instruction Scopeconcern

      Runtime instructions tell the agent to read and write files under user home paths (~/.openclaw and C:\Users\Administrator\...), add files to an Obsidian directory, and extract entities. Those actions involve accessing local filesystem data and modifying user notes; the instructions give broad filesystem targets and hard-coded, platform-specific paths (Windows Administrator) rather than a configurable vault path.

      Install Mechanismnote

      There is no install spec (instruction-only), which limits installer risk. However, the runtime depends on a local script that is not provided; the absence of an install step or included code means the skill will either fail at runtime or rely on pre-existing, opaque local scripts.

      Credentialsnote

      The skill requests no credentials or environment variables (reasonable), but it also fails to declare the need for Python or any NLP/embedding service keys that entity extraction or vector indexing might require. The lack of declared dependencies is inconsistent with the described functionality.

      Persistence & Privilegeok

      always:false and no special OS restrictions are set. The skill does instruct filesystem writes at runtime, but it does not request permanent elevated platform privileges in its metadata.

      Guidance

      This skill's instructions expect a local Python script (C:\Users\Administrator\.openclaw\scripts\vector_kb.py) and write/read locations under ~/.openclaw and an Obsidian vault, but the package contains no code and declares no dependencies. Before installing or using it: (1) ask the publisher for the actual script/source and an install plan; (2) do not run commands that write into your home or notes until you inspect the script contents; (3) confirm which OS/path the skill targets (it mixes Windows and Unix paths) and request configurable vault paths; (4) ensure Python and any required NLP/embedding services are explicitly declared; (5) if you must test, run in a sandboxed account or VM and review the script for data-exfiltration or unexpected behavior.

      Latest Release

      v1.0.0

      taizi-knowledge-base v1.0.0 - 首次发布,集成个人知识库管理功能。 - 支持向量检索、实体关系管理、笔记存储一体化。 - 提供便捷命令行操作:知识内容存入、检索、统计、添加笔记文件。 - 支持自动分块文本、实体关系抽取、文件索引检索。 - 统一管理知识数据,提升个人信息的组织与查找效率。

      Popular Skills

      self-improving-agent

      @pskoett · 1,456 stars

      Gog

      @steipete · 672 stars

      Tavily Web Search

      @arun-8687 · 620 stars

      Find Skills

      @JimLiuxinghai · 529 stars

      Proactive Agent

      @halthelobster · 426 stars

      Summarize

      @summarize · 415 stars

      Published by @tangepier-crypto on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]