Install
$ agentstack add skill-roypriyanshu02-spelunk-spelunk ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Spelunk
Spelunk indexes codebases into local SQLite via Tree-sitter. Querying the index replaces slow file scans (cat/grep) and saves up to 90% of token budget.
Database persistence
.spelunk/data.db (or SPELUNK_DB_PATH) persists across agent sessions. Index status and metadata are durable. Re-verify index freshness only on command failure or file modifications. Do not check environment or rescan on session start.
Guidelines
🚀 Environment & Index Lifecycle
- Check Before Scanning: Run
scan.mjsonly when.spelunk/data.dbis missing/empty or on initial workspace setup. - Incremental Updates: Limit rescans to modified files when stderr indicates the index is out of date.
🔍 Search & Dependency Resolution
- Symbol & Dependency Lookups: Use
deps.mjsto trace import chains down or up the tree instead of reading files line-by-line. Usefind.mjsto locate symbol definitions. - Fuzzy Search: Query
files_ftstable viaquery.mjsfor trigram search when exact symbol lookups fail. - Refactor Impact: Run
diff.mjsafter modifying imports/exports to verify downstream dependencies before committing changes.
🛡️ Safety & Security
- Read-Only SQL:
query.mjsstrictly permits read-only statements (SELECT,WITH,PRAGMA,EXPLAIN). Always parameterize dynamic inputs with?placeholders. - Credential Protection: Credential files (
.env,.pem, SSH keys) are automatically excluded during scans. - Gitignore Hygiene: Ensure
.spelunk/is present in your workspace.gitignore.
⚡ Performance & Batching
- Token Efficiency: Default to
--format jsonfor intermediate agent reasoning to save tokens. Reserve--format markdownfor final user presentation. - Batching Queries: Combine sequential SQL lookups into a single
query.mjscall to avoid Node process startup overhead (~100–300ms per invocation). - Scoping Flags: Use
--limit,--file, and--queryto keep returned payloads targeted.
🪜 Resolution Ladder (Stop at first matching rung)
- Rung 1: Query existing SQLite index (
.spelunk/data.db). - Rung 2: Run
scan.mjsincrementally for modified files if index is stale. - Rung 3: Fall back to regex parsing (
--force-fallback) if WASM grammars fail offline. - Rung 4: Fall back to text search (
grep/cat) as last resort for single-file lookups.
⚠️ System Limitations
- File Size & Type: Files >1MB and binary files are skipped from AST parsing.
- Dynamic Constructs: Dynamic
import(), reflection, and C/C++ preprocessor macros are not evaluated statically.
Script usage
Run scripts from workspace root using Node.js. Replace ` with the absolute skill path. Global flags: --format (-f), --dir , --no-download, --force-fallback`.
Quick example: node /scripts/find.mjs Router
node /scripts/status.mjs []node /scripts/query.mjs "" [...]node /scripts/scan.mjs [] [--concurrency ] [-w|--watch]node /scripts/find.mjs |--query|-q [-l ] [-o ]node /scripts/outline.mjs |--filenode /scripts/deps.mjs |--file |--direction [|-d ] [-l ] [-o ]node /scripts/explain.mjs |--file [--set-summary ""]node /scripts/export.mjs []node /scripts/diff.mjs |--file-a |--file-b
> [!IMPORTANT] > WASM grammars fetch to ~/.cache/spelunk/wasm/ on first run. Force offline mode with --no-download (SPELUNK_OFFLINE=1), force fallback with --force-fallback (SPELUNK_FORCE_FALLBACK=1), or set custom grammars via SPELUNK_WASM_DIR. Credential files (.env, .pem, SSH keys) are automatically skipped. Ensure .spelunk/ is listed in .gitignore.
Database schema
Inspect [references/database.md](./references/database.md) for full DDL, indexes, and triggers.
files: Primary records (path,parsed,reason,hash,exports,imports,summary,summary_hash,mtime,size).file_imports: Resolved dependency links (file_path,imported_path).file_exports&file_raw_imports: Flat symbol name indexes (file_path,name).metadata: Workspace configuration (key,value). Known keys:rootDir,scanStatus,scanPid,lastScanTime,lastGitCommit.files_fts: Virtual FTS5 trigram search table auto-synced withfiles.
Reference payloads & SQL examples
Inspect Level 3 reference documentation for detailed contracts and schemas:
- [references/examples.md](./references/examples.md): Full JSON output payloads, error schemas, and SQL query examples.
- [references/database.md](./references/database.md): Deep-dive SQLite schema specs, index definitions, and trigram FTS configuration.
- [references/contracts.md](./references/contracts.md): Script invocation contracts and output interface definitions.
- [references/codemap.v1.json](./references/codemap.v1.json): JSON Schema (Draft-07) validation spec for codemap payloads.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: roypriyanshu02
- Source: roypriyanshu02/spelunk
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.