graphify

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask for and embed Neo4j credentials (URI, user, password) into runnable code/commands, which requires the LLM to handle and output secret values verbatim.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill contains multiple deliberate high-risk behaviors: it defaults to processing the current directory without asking, mandates sending file contents to an external "Agent" (exfiltrating local files to an LLM/service), and includes a likely typosquatted pip install command (supply-chain risk); it also persists query QA into the corpus, increasing data-exposure risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow runs semantic extraction subagents that “read the files listed” in Step B2/Part B (and Part B is used whenever docs/papers/images are present), meaning outsider-authored free text can be ingested via user-provided input paths to be extracted by the LLM-driven subagents.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill accepts and fetches arbitrary URLs at runtime (see "/graphify add " and ingest('URL', Path('./raw'))), and those fetched files are injected into the corpus and then read by the LLM subagents (Step B2), which effectively injects external content into the model context and can influence prompts/behavior.