The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local files and remote URLs for knowledge graph extraction. Subagents are given general-purpose permissions (bash and write access) to process this data. The subagent instructions lack explicit delimiters or sandboxing for the input file content, which could allow malicious files in a repository to influence agent behavior during semantic extraction.
Ingestion points: File discovery via detect.py and semantic extraction in skill.md (Step 3B).
Boundary markers: Absent in the subagent prompt template for FILE_LIST content.
Capability inventory: Subagents have bash and write access (general-purpose).
Sanitization: Strong URL validation is present in security.py, but no content sanitization is applied to repository files before they are read by subagents.
[PERSISTENCE]: The skill includes functionality to install git hooks (post-commit and post-checkout) via hooks.py. These hooks execute a Python script to rebuild the knowledge graph whenever changes are detected in the repository. While this is an automation feature, it constitutes a persistence mechanism that executes code automatically on user actions.
[COMMAND_EXECUTION]: The instructions in skill.md and related platform-specific skill files frequently use bash and PowerShell to execute Python scripts, install packages, and manage files. These operations are core to the tool's installation and update cycles but involve arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The skill fetches the graphifyy package from PyPI during installation and can download external content from URLs (including PDFs, images, and video transcripts) using yt-dlp and safe_fetch. The skill implements robust URL validation via security.py to prevent SSRF attacks.

graphify