The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation refers to the tool as 'graphify' but the installation commands use 'graphifyy' (with a trailing 'y'). This discrepancy between the tool's name and its package name is a characteristic pattern for typosquatting attacks, where attackers register similar-sounding names to trick users into installing malicious software.
[COMMAND_EXECUTION]: The skill provides instructions to execute uv tool run and pipx install targeting the unverified 'graphifyy' package. This facilitates the execution of arbitrary remote code on the user's system without version pinning or integrity verification.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it transforms an entire untrusted codebase into a knowledge graph that the AI agent then queries.
Ingestion points: The skill crawls the entire local workspace (using graphify .) including source code, SQL schemas, and documentation (SKILL.md).
Boundary markers: There are no instructions or delimiters provided to ensure the agent ignores malicious instructions that might be embedded in the files being indexed.
Capability inventory: The skill possesses the ability to execute shell commands (uv tool run, pipx), perform network operations via the MCP server integration, and write files to the /output/graphify/ directory.
Sanitization: The tool performs Tree-sitter AST parsing but does not include mechanisms to sanitize or filter out prompt injection payloads contained within the parsed code or comments.

graphify