Risky: graphify - skill.md | Skillgate

Skillgate scanned graphify/skill.md in graphify and rated it Risky with a risk score of 24/100 (3 detections).

Skillgate found low-to-medium risk patterns that are common in legitimate files but worth a look before you trust the file.

What was found

• SG-012 Suspicious URL - MEDIUM: HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-054 Authority Impersonation - MEDIUM: Vendor / trust-team identity claim paired with imperative action
• SG-076 Skill description semantic lure - MEDIUM: Skill `description:` contains broadening phrase ('any time', 'always', 'whenever') that triggers auto-invocation on nearly every user prompt, combined with model invocation NOT disabled.

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.