graphify
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses extensive shell commands to manage environment setup and execute the graphify tool. These commands are necessary for the primary function of the tool, such as identifying the Python interpreter, running AST extraction, and handling incremental updates.
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'graphifyy' package from the standard Python Package Index (PyPI) and includes optional functionality to fetch URLs (YouTube, Twitter, arXiv) into a local folder. These operations are explicitly requested by the user or required for core functionality.
- [DATA_EXFILTRATION]: No evidence of unauthorized data transmission was found. Network activity is limited to downloading the tool's own dependencies or fetching user-specified URLs for ingestion into the graph.
- [PROMPT_INJECTION]: The skill contains instructional language for subagents to extract graph fragments but does not attempt to bypass core agent safety guidelines or override system prompts.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were detected. The skill correctly handles Neo4j credentials by instructing the agent to ask the user if they are not provided.
Audit Metadata