Codebase Search

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

This is a disclosed local Python code search indexer with manageable risks from indexing source code, persisting a local index, and installing an unpinned dependency.

Install this only in repositories you are comfortable indexing locally. Add `.codebase_index/` to `.gitignore`, run it from a virtual environment, and consider pinning `chromadb` before use. Avoid pointing it at broad home directories or repositories containing secrets in Python source files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14; references/integration.md:87-92
Vulnerability Type: Unpinned and integrity-unverified package installation
Risk Level: Medium

Vulnerable Code

SKILL.md:14:

markdown

Copy `scripts/code_chunker.py` and `scripts/code_index.py` into your project. They have no dependencies beyond `chromadb` (install with `pip install chromadb`).

references/integration.md:87-92:

markdown

## ChromaDB dependency

```bash
pip install chromadb
# or in a venv:
.venv/bin/pip install chromadb

text

### Technical Analysis

The installation instructions request `chromadb` without specifying an audited version, cryptographic hashes, a lockfile, or a trusted package index. Package resolution is therefore mutable: the installed package and its transitive dependencies may differ between installations or change after this Skill has been audited.

The dependency is imported at runtime in `scripts/code_index.py:30`. Consequently, code supplied by the resolved package can execute with the privileges of the user running the indexer. Although no malicious behavior was identified in the Skill's own scripts, the documented installation process does not protect users against a compromised upstream release, compromised transitive dependency, unsafe future release, or package-index substitution.

### Attack Path

1. An attacker compromises the `chromadb` distribution, one of its transitive dependencies, or the package index used by the victim.
2. The victim follows the documented `pip install chromadb` command.
3. Pip resolves the attacker-controlled or unexpectedly changed package because no version or integrity constraints are enforced.
4. Malicious package code executes during installation or when `chromadb` is imported by `scripts/code_index.py`.
5. The malicious code operates with the installing or indexing user's privileges and may access the repository being
...[truncated 507 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin chromadb to a specifically reviewed version, for example chromadb==<reviewed-version>.
2. Place direct and transitive dependencies in a lockfile or requirements file containing cryptographic hashes.
3. Install with hash verification, such as pip install --require-hashes -r requirements.txt.
4. Configure pip to use an explicitly trusted package index and disable unintended fallback indexes.
5. Perform installation and execution in an isolated virtual environment under a non-privileged account.
6. Add automated dependency vulnerability and provenance scanning to the release process.
7. Periodically review and deliberately update pinned versions rather than allowing implicit upgrades.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes capability to read and index an entire repository, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, that omission can let the skill be invoked without clear sandboxing or least-privilege constraints, increasing the chance of unintended access to sensitive source files, secrets, or proprietary code during indexing/search operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When force_rebuild is true, the code deletes the existing ChromaDB collection and recreates it, which is a destructive operation affecting persisted index data. There is no confirmation prompt, visible log message, or explanatory warning near the operation to disclose that existing indexed data will be removed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.