Codebase Intelligence

What to check before installing or running this skill: - Review indexer.py and scripts/main.py in full for any network calls, subprocess/os.system usage, or imports of third-party libraries that might reach out to external services. The truncated snippets don't show network calls, but the indexer was not fully shown. - Be cautious about running it against sensitive repositories: the tool indexes and caches full file contents under <project>/.codebase-intelligence/, so secrets or credentials in the repo will be read and stored locally. - The SKILL.md mentions a cache file named codebase_index.pkl. If the code loads that file using pickle, loading an attacker-controlled pickle can execute arbitrary code. Confirm the cache format and refuse to load caches from untrusted locations. - The bundle contains incomplete/truncated code and apparent syntax/logic issues in the provided snippets (e.g., truncated functions/lines). That indicates it may crash or behave unexpectedly; treat it as not production-ready until fixed. - Do not add the suggested git hook to important repositories until you have reviewed the hook script; adding it will cause the tool to run automatically on commits. - If you want to try it, run it in a disposable/sandboxed environment and against a non-sensitive repository first. Consider running Python in a virtualenv and inspect the created cache directory after indexing. If you want, I can: (1) scan the remaining/truncated files for network or unsafe deserialization usage, (2) point out exact lines that indicate syntax errors, or (3) suggest safer alternatives for caching (e.g., JSON rather than pickle) and sandboxed invocation commands.