菜单
Only reach for external web search when the local corpus comes back empty or clearly insufficient. Forces the agent to try knowledge-rag first, then explicitly document why it needed to escalate. Prevents wasted API cost, latency, and (in air-gapped deployments) accidental network calls.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
基于 SOC 职业分类
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/lyonzin/knowledge-rag --skill rag-web-fallback命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
For any security-related task — threat triage, incident response, MITRE ATT&CK mapping, CVE lookup, exploit analysis, defensive control validation, red/blue/purple team work — always consult the local corpus first. Assumes the RAG is loaded with security content (cybersecurity preset, MITRE data, threat reports, runbooks). Prevents wasted external threat-intel calls and grounds recommendations in the team's actual playbooks.
Before answering any technical question, code request, architecture decision, or factual claim, call search_knowledge to check the local corpus. Trigger on any query that could be answered with prior work, indexed docs, ADRs, runbooks, or team context. Prevents hallucination and forces reliance on the indexed knowledge base.
Every technical claim drawn from the local corpus must ship with a source citation formatted as path:line or path:section. Trigger whenever the response quotes, paraphrases, or acts on knowledge that came from a search_knowledge or get_document call. Makes answers auditable and lets the user jump to source in one click.
| name | rag-web-fallback |
| description | Only reach for external web search when the local corpus comes back empty or clearly insufficient. Forces the agent to try knowledge-rag first, then explicitly document why it needed to escalate. Prevents wasted API cost, latency, and (in air-gapped deployments) accidental network calls. |
| metadata | {"type":"rag-workflow","kind":"workflow","target":"any-mcp-client"} |
Whenever the agent is tempted to call an external tool for information (WebSearch, WebFetch, mcp__exa__*, mcp__context7__*, etc.), route through this skill's checklist first.
Applies to:
Does NOT apply to:
The agent will:
search_knowledge call before any web call, using appropriately extracted keywords.First-pass RAG:
search_knowledge(query="<extracted keywords>", max_results=5, min_score=0.15)
If 0 hits (or top score < 0.3), try a paraphrase. Common variants:
Second-pass RAG:
search_knowledge(query="<paraphrased keywords>", max_results=5, min_score=0.10)
Note: lower min_score (0.10) to catch weaker matches.
Decide:
| Local result quality | Action |
|---|---|
| Solid hit (score > 0.5) | Answer from RAG, do NOT hit web |
| Weak hit (score 0.15–0.5) | Answer from RAG and add a web-search suggestion "for more context" |
| No hit | Explicitly tell the user "corpus does not have this" then optionally invoke web search |
If escalating to web, prefix the answer with:
"The local knowledge base does not cover this (searched
<query1>,<query2>, 0 relevant hits). Falling back to external web search."
Then run the web tool (WebSearch, mcp__exa__web_search_exa, etc.).
Example 1 — RAG covers it, no web needed
User: "What is our retry policy for external HTTP calls?"
Agent:
search_knowledge(query="retry policy external http") → 2 hits, top score 0.79
Reply: "Per [docs/adr/0031-retries.md], the policy is 3 attempts with exponential
backoff starting at 1s, max 30s. See services/common/retry.py:12–28 for the impl."
(No web search performed.)
Example 2 — RAG empty, web fallback explicit
User: "What are the top CVEs in Python cryptography package in Q3 2026?"
Agent:
search_knowledge(query="cve python cryptography 2026", min_score=0.10) → 0 hits
search_knowledge(query="python cryptography vulnerabilities", min_score=0.10) → 0 hits
Reply: "The local corpus does not track CVE data (searched 'cve python cryptography 2026'
and 'python cryptography vulnerabilities', 0 hits). Falling back to external web search..."
[Then calls WebSearch or mcp__cti__vuln_cve]
Example 3 — Weak local hit + web supplement
User: "Explain the LangChain LCEL syntax."
Agent:
search_knowledge(query="langchain lcel syntax") → 1 hit, score 0.22
(a passing mention in one of your ADRs comparing frameworks)
Reply: "The corpus has one passing mention of LangChain LCEL in
[docs/adr/0044-framework-choice.md]. That does not fully explain the syntax
though — for the syntax reference itself, I will pull from LangChain's public docs."
[Then calls WebFetch on the LangChain docs URL]
mcp__cti__*, mcp__shodan__*, mcp__virustotal__*, mcp__context7__*, etc., prefer those over generic web search — they are usually more precise and faster.rag-check-first — the prerequisite (this skill is check-first with an explicit escalation rule).rag-cite-sources — if you DO answer from RAG, cite. If from web, cite the URL.rag-troubleshoot — troubleshooting has its own escalation path (StackOverflow, GitHub issues) that follows the same pattern.