Semantic Grep

Offline local semantic code search using embeddings to find and index code by meaning with llama.cpp, ONNX, or Ollama backends.

Before installing: (1) Treat the package as untrusted until you inspect its source—pip installing runs code that can do anything on your system. (2) Verify the PyPI package and GitHub repository referenced (rizperdana/semgrepll) and inspect the package contents or prefer building from source. (3) Remove or rotate any tokens you find in docs (the README includes a token-like string) and do not reuse it. (4) Consider running the install in a sandboxed environment or VM, or inspect the package with tools like 'pip download' and review the wheel/tarball. (5) Be cautious about the 'semgrep' command name collision—ensure it won't override or confuse an existing semgrep installation. If you want help, provide the actual PyPI package/source code and I can re-evaluate the install-time behavior and look for network calls or unsafe operations.

Type: OpenClaw Skill Name: semantic-grep Version: 1.0.0 The skill package 'semgrepll' shadows the command name 'semgrep', which is a widely used and well-known static analysis tool, creating a high risk of command hijacking or user confusion (seen in SKILL.md and clawhub.yaml). Additionally, the README.md includes a hardcoded installation token, and the _meta.json file contains a future-dated timestamp (2026), which are anomalous for a standard utility. While no direct evidence of data exfiltration or malicious code is present in the provided metadata, the intentional overlap with a popular security tool's namespace is a significant indicator of potential deceptive intent.