rag-optimization@1.0.1
VERIFIED· install onlyPublisher claims: "完整的RAG系统优化方案，涵盖21+种策略（Self-RAG、命题分块、上下文压缩、引用溯源、查询意图等）；提供诊断工具、实现代码与评估框架；当用户需要优化知识库问答、提升检索准确率、降低幻觉或评估RAG效果时使用" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsscripts/evaluate.py:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 说明：项目实际使用 NVIDIA API（通过 .env 桥接），豆包变量名保持不变Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:318 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05**零配置加载**：`from llm_client import load_from_env; llm = load_from_env()` —— 自动读取环境变量（含 `.env` 文件）中的 API 凭证，配置方法见 [全局操作说明](references/global-operations.md)。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/llm_client.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 可选 .env 加载（H4：让 load_from_env() 名副其实）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/evaluate.py:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05logger.debug(f".env 加载状态: {'已加载' if DOTENV_LOADED else '未加载（依赖真实环境变量）'}")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/evaluate.py:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 自动加载 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/llm_client.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 方式 2：从 .env 自动加载 NVIDIA 配置（零配置）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:442 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- **环境准备**：参考 [全局操作说明](references/global-operations.md) 完成依赖安装和配置；LLM 凭证通过环境变量或项目根目录 `.env` 文件注入（格式模板见该文档 1.4 节），切勿将真实凭证写入任何被分发/提交的文件Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/evaluate.py:202 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05source = "环境变量 NVIDIA_API_KEY (自动桥接，来自 .env)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/evaluate.py:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# 方式 4：桥接 NVIDIA API 凭证（来自 .env 文件）Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:424 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05| [global-operations.md](references/global-operations.md) | 全局操作说明（环境准备、LLM 凭证配置、`.env` 格式、参数调优） |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/llm_client.py:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05是否成功加载了 .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/llm_client.py:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05尝试加载 .env 文件；python-dotenv 未安装时静默跳过。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/llm_client.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05因此真实环境注入的凭证优先级高于 .env（符合直觉）。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈3,164 tok
1 file · 37 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.