graphify-knowledge-graph
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python harness script at
.codex/skills/scripts/graphify_harness.pyusing user-provided parameters likeproject_dirandtargetto perform graph operations.- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from external sources such as Obsidian vaults and codebase ASTs, creating a surface for potential instruction injection in processed data. - Ingestion points: Project directories and files processed by the indexing action.
- Boundary markers: No specific delimiters or safety instructions are defined to separate data from instructions.
- Capability inventory: The harness performs local file reads, writes to the
.graphify/folder, and CLI execution. - Sanitization: The skill description does not specify methods for sanitizing or validating the indexed content.
Audit Metadata