The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of the Python package graphifyy via uv tool install or pip install. This name is a potential typosquat of the legitimate and widely-used graphify package. The package is downloaded from a public registry and its source code is not verified within the skill.
[COMMAND_EXECUTION]: The skill configures a git pre-commit hook (in .git/hooks/pre-commit or .husky/pre-commit) that executes graphify update automatically. This establishes a persistence mechanism where third-party code is executed every time a user performs a git commit in the repository.
[PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface. The graphify tool ingests the entire codebase to build a knowledge graph, which is then provided to the AI agent to influence its reasoning.
Ingestion points: The tool reads all files in the current directory (excluding those in .graphifyignore) via graphify update . in the pre-commit hook and graphify extract . in the initial setup (SKILL.md).
Boundary markers: The skill does not provide any instructions or markers to help the agent distinguish between the graph data and its own system instructions.
Capability inventory: The skill has the capability to install packages, modify git configurations, write shell scripts to hook directories, and execute shell commands.
Sanitization: There is no evidence of sanitization or filtering of the content extracted from the codebase before it is incorporated into the graph and presented to the agent.

setup-graphify