se-dev
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The preparation scripts (
GraphifyPrepare.bat,graphify-prepare.sh) automate the installation of thegraphifyypackage from PyPI, an official and well-known package registry, using standard package managers such asuv,pipx, orpip. - [COMMAND_EXECUTION]: The skill executes various system commands for environment setup and maintenance, including disk space verification via PowerShell on Windows and directory management (
mkdir,rmdir,rm -rf) across supported platforms. - [DYNAMIC_EXECUTION]: The health check utility (
graphify-check.sh) executes dynamically generated Python code using heredocs to validate the integrity and community structure of JSON clustering data produced by the graphing tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied project code (scripts, mods, and plugins) to build navigable structural graphs. It includes mitigation measures such as an explicit exclusion list for non-code files (e.g., .md, .txt, .pdf) to prevent accidental processing of unstructured text by LLM-based extraction backends.
Audit Metadata