Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Codebase Search
v1.0.0Build a persistent semantic vector index over a Python codebase and search it with natural language. Use when an agent needs to find relevant classes, functi...
⭐ 0· 62·0 current·0 all-time
byRyne Schultz@ryno2390
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (persistent semantic vector index over a Python codebase) matches the code and instructions: the scripts chunk .py files and persist vectors to a local .codebase_index using ChromaDB. However, code_index.py and SKILL.md reference a package namespace (prsm.compute.nwtn.corpus.* and a convenience import path) that does not match the provided file layout (scripts/*.py). That mismatch means the scripts will likely fail if simply copied into a project as the Quick Start suggests.
Instruction Scope
Runtime instructions and the code stay within the stated purpose: they scan Python files (with explicit exclude patterns), extract top-level classes/functions via ast, store docstrings/snippets, and run local ChromaDB queries. The skill does read the repository tree and files (expected for this purpose) and persists an index to {repo_root}/.codebase_index/; it also instructs adding that dir to .gitignore.
Install Mechanism
There is no install spec (instruction-only), which is low-risk, but the SKILL.md requires pip install chromadb and mentions onnxruntime/tokenizers. The code imports chromadb at runtime. The documentation omits explicit steps for making the provided scripts available under the prsm.* package namespace, creating a likely friction/operational issue. No remote downloads or obscure URLs are used.
Credentials
The skill requests no environment variables, credentials, or config paths. It only needs local filesystem access to the repository to index and to write the .codebase_index persistence directory — this is proportional to its stated purpose.
Persistence & Privilege
The skill persists an index under the repo (.codebase_index) and asks users to .gitignore it. It does not request always:true and does not modify other skills or system-wide settings. The persistence is limited to its own directory.
What to consider before installing
This skill appears to do what it says—build a local ChromaDB-based semantic index of Python code—but there are practical inconsistencies you should be aware of before installing or copying files:
- Import/path mismatch: code_index.py uses imports like from prsm.compute.nwtn.corpus.code_chunker import CodeChunker and the SKILL.md shows convenience imports under prsm.compute.nwtn.corpus. The provided files live under scripts/. If you copy the scripts into a project as-is, those imports will likely fail. Either run the scripts from a package layout matching prsm.* or edit imports to use relative/local module names (e.g., import code_chunker).
- Dependencies: you must install chromadb (and its runtime dependencies such as onnxruntime/tokenizers) as noted. Verify those packages are acceptable in your environment (they can be heavy and may require native wheels).
- Local indexing and privacy: the index is persisted to {repo_root}/.codebase_index and will contain snippets and docstrings from your code. Add that directory to .gitignore (as SKILL.md suggests) and consider whether you want it included in backups or shared storage.
- Behavior is local-only: there are no network calls or secret exfiltration in the code, but the indexer will read all .py files not excluded by default. Review the exclude list and adjust if you need to skip sensitive directories.
Recommended next steps: test in a disposable/sandbox repo first, fix the import paths or package layout before using in production, and confirm chromadb works in your environment. If the package is to be used by an agent, ensure the agent's runtime has chromadb and the correct module path available.Like a lobster shell, security has layers — review code before you run it.
agentic-codingvk97dvzq4gwbjvq00ebcm96afbx83vcfcchromadbvk97dvzq4gwbjvq00ebcm96afbx83vcfclatestvk97dvzq4gwbjvq00ebcm96afbx83vcfcpythonvk97dvzq4gwbjvq00ebcm96afbx83vcfcsemantic-searchvk97dvzq4gwbjvq00ebcm96afbx83vcfc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
