The Agent Skills Directory

[PERSISTENCE]: The tool automates graph maintenance by installing git post-commit and post-checkout hooks. These hooks trigger background rebuilds of the knowledge graph whenever changes are committed or branches are switched, ensuring the agent always has access to an up-to-date architectural model.
[COMMAND_EXECUTION]: To integrate with various ecosystems, the skill executes system commands via subprocess.run, including calls to cpp for Fortran file preprocessing, the gh CLI for pull request analysis, and the gws CLI for Google Workspace document exports. The skill instructions also frequently use python -c to execute library logic directly from the agent's shell.
[INDIRECT_PROMPT_INJECTION]: As the tool ingests untrusted data from local files, external URLs, and PR diffs, it faces a significant indirect prompt injection surface. It mitigates this by wrapping all external content in untrusted_source XML blocks and neutralizing known chat-template sentinels (e.g., <|im_end|>, <>) using zero-width spaces to prevent them from being interpreted as instructions by the backend LLM.
[DATA_EXFILTRATION]: The tool's primary purpose involves sending analyzed codebase and documentation segments to third-party LLM providers (e.g., Anthropic, OpenAI, Google). While this is intended behavior, it constitutes a planned flow of potentially sensitive data to cloud services. The tool includes system prompt instructions to the extraction models to treat this data as inert.
[DYNAMIC_EXECUTION]: Graphify utilizes dynamic imports via importlib for efficient lazy-loading of its multi-language extractors and LLM backends. The agent instructions also perform dynamic Python execution in the shell to manage graph state and lessons learned across sessions.
[SAFE]: Implements a comprehensive SSRF guard in security.py that validates all network requests against private, reserved, and cloud-metadata IP ranges. It uses a single-resolution architecture and custom HTTP handlers to eliminate DNS-rebinding TOCTOU hazards during URL ingestion.

graphify