search-codebase — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited search-codebase (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
FileSift indexes codebases and enables natural language search via hybrid keyword (BM25) + semantic (FAISS embeddings) search, merged with Reciprocal Rank Fusion.
Use FileSift when the target is a concept or behaviour, not a known identifier.
Reach for FileSift when:
retry, backoff, exponential_sleep, with_retries …)Prefer grep / glob instead when:
The rule of thumb: if you'd have to guess the right grep pattern, FileSift will outperform it. If you already know the exact token, grep is faster.
Do this before anything else, every time this skill is invoked for the first time in a session.
filesift --versionIf the command is found, proceed to Quick start.
If it isn't found, install it. FileSift requires Python 3.12+ and is published on PyPI. The right install command depends on how the user manages Python packages. Always ask the user before running any installation commands.
| Environment | Install command |
|---|---|
| pip (default) | pip install filesift |
| uv (tool) | uv tool install filesift |
| uv (project) | uv add filesift |
| pipx | pipx install filesift |
| poetry | poetry add filesift |
| pdm | pdm add filesift |
| conda / mamba | pip install filesift (inside the active conda env) |
After installing, confirm with filesift --version before proceeding.
ls <project-root>/.filesift/If .filesift/ exists, skip to step 3.
filesift index <project-root>filesift find "<natural language query>" --path <project-root>Use conceptual descriptions, not code syntax:
Results are ranked by relevance score (0-1). Read the top results to understand the actual implementation.
Iterating on results
A single search is rarely enough for complex questions. If the top results don't contain what you're looking for, don't stop — reframe and search again. Treat FileSift like a conversation: each result gives you vocabulary (function names, module names, patterns) you can feed into the next query. Common iteration strategies:
"parse JWT claims" instead of "authentication")"token refresh" instead of "login")"session store write", "user lookup by id")Only conclude that something doesn't exist in the codebase after at least 2–3 differently-framed queries come up empty.
Formulating effective queries
The semantic index embeds raw source code. The embedding model (jina-embeddings-v2-base-code) was trained on 150M+ natural language / code pairs, so it bridges intent-based queries directly to code. Despite this, query quality directly determines result quality — the model encodes each query into a single dense vector, so a vague or overloaded query produces a vague result.
Core rule: Translate the user's request into a short (3–7 word) description of what the target code does, as a developer would phrase it in a docstring. Do not paste the user's question verbatim.
Guidelines:
| User request | Bad query | Good queries |
|---|---|---|
| "How does the app handle user login and JWT tokens?" | "how app handles user login and JWT token management" | "user authentication" + "JWT token validation" |
| "I want to understand how database errors are caught and retried" | "catching retrying database errors logic" | "database error handling" |
| "Where is the config loaded from at startup?" | "config loading parsing startup initialization" | "configuration loading" |
| "How does payment processing work, including webhooks?" | "payment processing webhooks implementation" | "payment processing" + "webhook handler" |
filesift index <project-root> --reindexUse --reindex to force a full rebuild. Without it, only changed files are re-indexed.
--path can be omittedfilesift config set search.MAX_RESULTS 20.filesift/ directory; index each separatelySee references/ADVANCED.md for daemon management, configuration tuning, and troubleshooting.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.