The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill attempts to install a Python package named graphifyy. There is a notable discrepancy between the package name (graphifyy with a double 'y') and the module it imports (graphify), which is a characteristic pattern of typosquatting attacks targeting the graphify namespace.
[PERSISTENCE]: The skill includes functionality to install a post-commit git hook via graphify hook install. This ensures that the skill's logic is automatically executed whenever a commit is performed in the repository, establishing a persistent execution mechanism.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (documents, papers, images, and videos) to build knowledge graphs.
Ingestion points: The detect() function in SKILL.md and EXTENDED.md scans user-provided directories (INPUT_PATH) for diverse file types.
Boundary markers: The extraction prompt in references/extraction-spec.md provides no explicit delimiters or instructions to distinguish between the agent's instructions and the content of the files being processed.
Capability inventory: The skill uses spawn_agent for semantic extraction and a query engine to provide answers based on the graph, creating a path for malicious content in files to influence agent output.
Sanitization: There is no evidence of content sanitization or instruction filtering for the ingested data.
[PRIVILEGE_ESCALATION]: The installation script in SKILL.md utilizes the --break-system-packages flag. This allows the skill to bypass environment isolation and modify system-level Python installations, which can lead to system instability or unauthorized environment modification.
[DYNAMIC_EXECUTION]: Multiple steps (Step 1, 2, 3A, 4, 5, 9) use python -c to dynamically generate and execute Python code blocks that handle core logic, including graph building and manifest management.
[REMOTE_CODE_EXECUTION]: The skill supports cloning arbitrary GitHub repositories using graphify clone, which involves downloading and subsequently processing remote code and content. It also allows pushing graph data to remote Neo4j and FalkorDB instances using user-supplied URIs and credentials.

graphify