Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local semantic code-search helper; its indexing and agent-integration behavior is disclosed and purpose-aligned, with some setup actions users should run deliberately.
Install only if you want ColGREP available for local semantic code search. Run indexing and agent-integration commands intentionally, add .colgrep/ to .gitignore, and avoid the rebuild command unless you are in the intended project directory and want to discard the existing local index.
The troubleshooting guidance includes a destructive shell command, rm -rf .colgrep/ && colgrep init. Although scoped to a hidden project directory, recursive deletion is still a dangerous pattern in agent-mediated execution because path confusion, directory mislocation, or command reuse could delete unintended data.
Re-index from scratch:
rm -rf .colgrep/ && colgrep init
Add to .gitignore:
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
For a complete rebuild:
rm -rf .colgrep/
colgrep init
The trigger list includes very broad phrases like 'search the code', 'find where', and 'code search', which are common in ordinary development conversations. That can cause unintended invocation of this skill in contexts where the user did not explicitly request semantic indexing/search, increasing the chance of unexpected local actions such as indexing a repository or registering integrations.
The skill encourages commands that create and maintain a .colgrep/ index and install agent integrations, but it does not clearly warn that these operations modify the user's workspace and potentially agent configuration. In an automated agent setting, omission of these side effects can lead to surprising changes to local state and reduced user control over environment modifications.
This markdown file includes a rebuild sequence using rm -rf .colgrep/, which performs irreversible local file deletion. Although it is limited to the tool's index directory, the surrounding documentation does not explicitly warn users that the command deletes existing index data before reinitializing it.