graph — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited graph (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build a map of how this AIOS actually fits together — which code files and which wiki notes depend on, reference, and cluster with each other — so you can see the structure instead of guessing it. Powered by graphify (a knowledge-graph builder), scoped hard to what's safe to graph.
/wiki loop that added entries — to refresh the picture./weekly review: what's load-bearing, what's orphaned, what's surprisingly connected./graph-query (this builds/refreshes the graph it queries).graphify writes everything to `graphify-out/` (git-ignored — a derived artifact, never committed):
## Knowledge graph — <date>
**Built from** — code (local AST) + committed wiki/. Excluded: raw/, .tmp/, .env, secrets.
**Artifacts** — graphify-out/graph.html (interactive) · graph.json · GRAPH_REPORT.md
**God Nodes** — the most-connected hubs (what everything leans on):
1. <node> — <why it's central, in a phrase>
2. … 3. …
**Surprising Connections** — edges you wouldn't expect (cross-domain links worth a look):
- <A> ↔ <B> — <what the link is>
**Suggested Questions** — what the graph invites you to ask next:
- <question> → run `/graph-query "<question>"`Every edge carries graphify's honesty label — EXTRACTED (read directly), INFERRED (reasoned), or AMBIGUOUS — so claims about the graph cite their basis (cite-don't-invent).
python tools/graphify_setup.py check. If missing, offer to install (uv tool install graphifyy, fallback pipx install graphifyy / pip install graphifyy, then graphify install --platform claude). No account or signup is needed. Gate: don't proceed until graphify --version resolves.tools/, etc.) and the committed wiki/.raw/ (may hold raw PHI/PII/financials before de-identification), .tmp/, .env, graphify-out/, and any sensitive/secret path. Never point graphify's document extraction at raw/.wiki/, which is already de-identified and non-confidential per the wiki admission policy. graphify also auto-skips sensitive files during detection — but scope, not that fallback, is your guardrail./graphify . (graphify's global skill), having confirmed scope. Non-code text in wiki/ is extracted by this session; graphify does not call any third party or read ANTHROPIC_API_KEY in-IDE.graphify update <path> — re-extracts the code AST deterministically, no model call. Prefer this when only code changed.graphify-out/graph.json and GRAPH_REPORT.md were written before reporting.graphify-out/GRAPH_REPORT.md and summarize into the output shape above — God Nodes, Surprising Connections, Suggested Questions — keeping the EXTRACTED/INFERRED/AMBIGUOUS labels. Point the user at graphify-out/graph.html for the interactive view./graph-query "<question>" to explore (shortest paths, neighbors, communities), and — if the user wants it standing — graphify hook install for auto-rebuild on commit (a Cadence touch) or --watch for continuous rebuild while working.L2 — drafts/refreshes the graph; the human reads it. Building is reversible and lands only in git-ignored graphify-out/, so it's safe to run on request. A code-only `graphify update` (deterministic, no LLM, no document pass) can run at L3 — e.g. via the commit hook — once trusted. Never commit graphify-out/; never widen scope beyond code + wiki/ without explicit approval.
.env, .tmp/, secrets) — raw/ can hold pre-de-identified PHI/PII/financials. Document extraction is limited to the committed, de-identified wiki/. (Guardrails #1, #2, #7)ANTHROPIC_API_KEY read.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.