skills/agentskillexchange/skills/Turn mixed local folders into a queryable knowledge graph with Graphify/Gen Agent Trust Hub
Turn mixed local folders into a queryable knowledge graph with Graphify
Fail
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill promotes the installation of a Python package named
graphifyy. The project documentation and associated GitHub repository (safishamsi/graphify) consistently refer to the tool asgraphify. Directing users to a misspelled package name is a classic indicator of a typosquatting supply chain attack, designed to trick users into installing malicious software instead of the intended tool.\n- [COMMAND_EXECUTION]: The instructions provide shell commands to install software viapip,pipx, anduv(pip install graphifyy), and to execute the tool locally (graphify .). These commands interact directly with the user's shell environment and file system.\n- [PROMPT_INJECTION]: The skill metadata contains averificationfield set tosecurity_reviewed. Per the adversarial reasoning framework, such self-declarations of safety are treated as deceptive markers attempting to bypass automated or manual security reviews.\n- [DATA_EXPOSURE]: The skill's primary function is to ingest mixed local folders containing code, documents, and media for processing. Given the use of a suspicious external dependency (graphifyy), this ingestion creates a high risk of sensitive data exposure or exfiltration.
Recommendations
- AI detected serious security threats
Audit Metadata