Security audit
Security checks for vulnerabilities and agentic risk
This is an offline local search skill, but it can silently delete or overwrite user-chosen files when building indexes or saving results.
Install only if you are comfortable running a local indexing script. Use a dedicated index filename in a safe working directory, avoid pointing --db or --out at existing important files, and remember that it only indexes .md and .txt content despite the broader code-search wording.
The skill advertises executable commands that read directories, create or modify a SQLite database, and invoke Python from the shell, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability, because a host agent may permit broader filesystem or shell access than users expect from the manifest alone.
The index command unconditionally deletes any existing database path supplied by the user before rebuilding it. In a local file-processing skill, this can destroy arbitrary files at the specified path if the operator passes the wrong target, causing denial of service or data loss even without elevated privileges.
The manifest describes the skill as a local BM25 engine for both code and text search, but the indexer only traverses files matching '.md' and '.txt'. No source-code file types are indexed, so the implemented behavior is materially narrower than the stated capability.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(*args):
r = subprocess.run([sys.executable, IR] + list(args),
capture_output=True, text=True)
assert r.returncode == 0, r.stderr
return r.stdout
When --out is provided, the code opens the target path in write mode and dumps JSON, which can create or overwrite a file. There is no confirmation, warning print, or nearby documentation disclosing this file write behavior.
No suspicious patterns detected.