graphify-windows

SUSPICIOUS. The core behavior mostly matches the stated purpose of building and querying knowledge graphs, and the install path appears to use the official PyPI package. However, the skill has a broad footprint: arbitrary folder ingestion, arbitrary URL fetching, parallel subagent analysis of untrusted content, optional persistent hooks/watchers, and optional outbound Neo4j export. The main concern is not obvious malware but a medium-risk combination of broad file access and indirect prompt-injection exposure that is larger than a minimal graphing helper needs.