Skill Graphify

Turn any folder of code, docs, papers, or images into a queryable knowledge graph. Cross-platform wrapper for graphify CLI.

The wrapper/script is coherent with its stated purpose, but it will attempt to install the PyPI package 'graphifyy' at runtime. Before installing or running this skill: 1) verify the 'graphifyy' package on PyPI (owner, versions, release history) and inspect its source repository for malicious or surprising behavior; 2) prefer running the wrapper in an isolated environment (VM, container, or virtualenv) so install-time code can't affect your system; 3) consider manually installing a vetted version of the graphify package (or using a pinned version) rather than letting the wrapper run pip automatically; 4) if you cannot confirm the package provenance, do not run ensure-installed or build on sensitive directories (run it on a disposable copy of data first). If you want, I can help look up the 'graphifyy' package, its PyPI page, or search for a source repository to validate provenance.

Type: OpenClaw Skill Name: skill-graphify Version: 1.0.0 The skill exhibits high-risk behavior by automatically installing an external Python package ('graphifyy') and executing dynamically generated Python code via 'subprocess.run' in 'graphify_wrapper.py'. While these actions are consistent with the stated purpose of building a knowledge graph, the execution pattern (using 'sys.executable -c' with f-strings) and the potential typosquatting risk of the package name ('graphifyy' vs the tool name 'graphify') create a significant attack surface for remote code execution (RCE) and supply chain compromise.