graphify

SUSPICIOUS. The core graph-building behavior matches the stated purpose, and the package source appears official, but the skill’s footprint is broad: silent package installation, arbitrary file/URL ingestion, parallel subagent processing of untrusted content, persistent local modifications, and optional credentialed Neo4j push. This is better viewed as a medium-risk powerful automation skill than malware.