graphify-windows

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs replacing placeholders with actual Neo4j credentials and to ask the user for credentials if missing (embedding URI/user/password into Python commands), which requires the LLM to handle and output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content contains multiple deliberate high-risk patterns: a repeated typosquatted install target ("graphifyy") suggesting supply-chain trickery, explicit instructions to process the current directory without user confirmation, and pipeline code that will upload arbitrary file contents to an externally configurable LLM endpoint (GRAPHIFY_API_URL/GRAPHIFY_API_KEY), plus mechanisms for persistence (git hook, CLAUDE.md integration) and agent orchestration that can be abused to exfiltrate sensitive data or run remote extraction covertly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests open web content (see "/graphify add " which supports "Any webpage" and Twitter/X in SKILL.md and the ingest/read-file flow used by the semantic extraction subagents and rebuild_graph.py's RAW_DIR→call_api pipeline), and those untrusted, user-generated pages are parsed and read by the agent as part of the mandatory extraction workflow that directly influences graph construction, suggested questions, and downstream actions.