The Agent Skills Directory

[OBFUSCATION]: A potential typosquatting pattern was detected. While the skill documentation, user instructions, and source links all refer to the tool as 'graphify', the actual installation logic in Step 1 specifically targets a package named 'graphifyy' via both 'uv' and 'pip'.
[EXTERNAL_DOWNLOADS]: The skill downloads and installs an unversioned Python package ('graphifyy') from a public registry during initialization. This poses a supply chain risk, especially given the naming discrepancy with the intended tool.
[PRIVILEGE_ESCALATION]: The installation script uses the '--break-system-packages' flag. This is a deliberate bypass of PEP 668 safety restrictions designed to prevent third-party installers from damaging the system-managed Python environment.
[PERSISTENCE]: The skill attempts to modify the agent's long-term behavior by creating a persistence rule in '.claude/rules/graphify.md'. This ensures that the agent follows instructions provided by the skill in future, unrelated sessions.
[DYNAMIC_EXECUTION]: The skill uses unsafe dynamic execution patterns. It extracts the shebang line from a local binary and executes it as a shell command ('"$(_SHEBANG)" -c ...'). Additionally, it stores the path to a Python interpreter in a hidden file ('graphify-out/.graphify_python') and subsequently executes commands using the content of that file via subshell expansion.

graphify