Codebase Search

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it claims: it locally indexes Python code for semantic search, with the main cautions being a persistent local index and an unpinned ChromaDB dependency.

This looks safe for local code-search use. Install ChromaDB in a virtual environment, pin the version if possible, verify the import path works in your project, and do not index repositories or files that contain secrets unless you are comfortable storing derived snippets in `.codebase_index/`.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private code snippets, docstrings, and symbol metadata may be stored locally and reused until the index is deleted or rebuilt.

Why it was flagged

The skill intentionally creates persistent local retrieval state from the codebase, so source-derived content may remain available across future searches.

Skill content
The index persists to `{repo_root}/.codebase_index/` and survives restarts.
Recommendation

Use it only on intended repositories, keep `.codebase_index/` out of git as instructed, and exclude files that may contain secrets or sensitive code.

What this means

A future or different ChromaDB package version could behave differently from the reviewed environment.

Why it was flagged

The setup relies on installing an unpinned external package, which is normal for this functionality but leaves version and provenance control to the user.

Skill content
They have no dependencies beyond `chromadb` (install with `pip install chromadb`).
Recommendation

Install in a virtual environment and pin a reviewed ChromaDB version in your project requirements.

What this means

Standalone use may fail or import a different local `prsm` module than expected.

Why it was flagged

The script imports `CodeChunker` through a project-specific package path even though the instructions also describe copying the standalone scripts, creating a possible missing-dependency or wrong-module issue.

Skill content
from prsm.compute.nwtn.corpus.code_chunker import CodeChunker
Recommendation

Before use, verify the import path matches your project layout, or change it to import the provided `code_chunker.py` directly.