graphify

SUSPICIOUS. The core Graphify CLI usage is coherent and mostly benign, with official same-org PyPI/upstream references. The main concern is proportional trust expansion: the skill directs installation of another skill from a third-party GitHub repo via `npx skills add`, plus unpinned installs and hook-based integrations. I found no clear credential theft, exfiltration endpoint, or hidden pre-execution malware behavior.