The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill contains a command in SKILL.md that automatically installs a Python package: pip install graphifyy -q. This is a high-risk finding because the package name ('graphifyy') differs from the library the skill attempts to import ('graphify'), a hallmark of typosquatting where a malicious package mimics a legitimate one.
[DATA_EXFILTRATION]: The script rebuild_graph.py is designed to read the content of all files in the raw/ directory and send them to a remote API endpoint defined by the GRAPHIFY_API_URL environment variable. While this is part of its stated 'semantic extraction' function, it provides a direct mechanism for the exfiltration of entire local directory contents to an external server.
[COMMAND_EXECUTION]: The skill makes extensive use of PowerShell to execute arbitrary Python code via python -c and manages the installation of external dependencies. This allows for the execution of unverified logic within the user's environment.
[EXTERNAL_DOWNLOADS]: The /graphify add <url> command utilizes graphify.ingest to download content from arbitrary URLs provided by the user, which may lead to the ingestion of malicious files into the graph-building pipeline.
[PROMPT_INJECTION]: The skill processes untrusted external data (code, documents, and images) to extract information. This represents an indirect prompt injection surface where malicious instructions hidden within the processed files could influence the behavior of the semantic extraction subagents.

graphify-windows