graph-query — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited graph-query (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ask the knowledge graph a relationship question and get a cited answer grounded in the graph — not a guess. The graph is built by /graph (graphify) over code + the committed wiki/. This skill only reads it.
graphify-out/graph.json exists, and the user has a question about how things relate:/wiki capture becomes a committed entry."wiki_lint.py and the commit gate."/graph.## Graph answer — <the question>
**Answer** — the relationship/explanation, in plain sentences, grounded only in graph edges.
**Path / nodes used**
- <node A> —[<relation>]→ <node B> (EXTRACTED · src: <path:line>)
- <node B> —[<relation>]→ <node C> (INFERRED — not literal in source)
**Citations** — source_location for each EXTRACTED edge (path:line).
**Gaps** — anything the question asked that the graph does NOT contain (say so plainly).Every claim traces to an edge. If the graph doesn't have it, the answer says so — it never fills the gap from memory.
graphify-out/graph.json is missing, stop and tell the user:"No graph yet — run /graph first to build it." Don't answer from training data or by re-reading files.
graphify query "<question>" (BFS, broad neighborhood).graphify query "<question>" --dfs (follows a path; --budget N to bound it).graphify path "A" "B".graphify explain "X" (the node + its neighbors).For richer interactive exploration, the graphify MCP server may be wired (python3 -m graphify.serve graphify-out/graph.json → query_graph, get_node, get_neighbors, shortest_path, god_nodes, graph_stats); use it when the question needs several hops or node lookups. Otherwise the CLI is enough.
source_location (path:line) for each edgeyou rely on. Fill the output shape above. Two hard rules:
and say the graph doesn't cover it — do not bridge it with a guess or by reading the file yourself.
EXTRACTED (literal in source),INFERRED (graphify's inference), or AMBIGUOUS (uncertain). Present only EXTRACTED as fact. Tag INFERRED/AMBIGUOUS edges as such inline — never pass them off as established.
L1 — read-only. Suggests/answers from the graph; the human decides. Builds nothing, sends nothing, writes no files. (To rebuild the graph, that's /graph, not this skill.)
source_location;unsupported parts of the ask are flagged as gaps, never fabricated.
EXTRACTED = fact; INFERRED/AMBIGUOUS are flagged as such,not stated as truth.
raw/,.env, .tmp/, and secrets. If asked about something outside that scope, say it isn't in the graph.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.