kg-compose — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited kg-compose (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn unstructured source material into structured, queryable graph facts in a named kgrdbms ontology. You are the extraction engine; the ontology supplies the opinion (how aggressive to be), and every write is gated and logged so a wrong call is reversible, not permanent.
You are mechanism; the ontology is policy. Don't impose a house style — read the target ontology's stance and honor it. A literal legal-notes ontology and an inferential research-notes ontology get different graphs from the same paragraph, on purpose.
material and confirm.
kg --json ontology list. If absent, create it:kg ontology create NAME --stance <literal|inferential> --description "…". If present, do not recreate it — read its existing stance/path from the list output and honor them.
From the registry entry: stance (free-text extraction guidance — see Stance below), allowed_kinds (if non-empty, prefer those kinds; extract others but flag that they're outside the ontology's allowlist), id_convention (default CURIE prefix:slug). These are the guidance you compose within.
{nodes, edges} modelid (a CURIE — see Id rules), kind (aTitleCase type like Person, Company, Method), name (display string), labels (set memberships), properties (JSON facts).
from, to, type (UPPER_SNAKE verblike FOUNDED, MADE_WITH, REPORTS_TO), and optional properties (facts about the relationship itself — year, confidence, source).
Write the whole {nodes, edges} model in a single bulk operation. Do not emit dozens of individual upsert calls — use the bulk path:
kg_import(nodes=[...], edges=[...], ontology="NAME") once.kg --ontology NAME import /tmp/compose.json --actor kg-compose.Both run the same gated + logged path inside one transaction — fast and fully recorded, so it survives replay. Every node/edge is still individually gated and reversible; bulk only collapses the commit, not the gate. Re-running on overlapping sources is safe: stable CURIE ids make re-imports merge, never duplicate. For a very large source, chunk into a few kg_import calls rather than one per entity.
kg --ontology NAME stats — what landed.kg --ontology NAME path A B (or a neighbors/out query) — show it'sactually connected, not just a pile of nodes.
kg --ontology NAME events -n 10 — the audit trail of this composition.inferred (so the user can see and revert it).
id = prefix:reference. prefix is a short stable lowercase type token(person, company, paper); reference is the slugged name.
person:ada-lovelace. Twospellings that slug the same must get the same id — that's how the same entity across two documents becomes one node.
go in properties. Never bake status=active into an id.
stance is free-text guidance the ontology carries about how to extract — a dial, not a switch, and not a fixed enum. Read it and apply judgment; the ontology's own words win. Common values, just to convey the range (not a menu to pick from):
named, relationships only if stated, never guess two mentions are the same. Fits legal, technical, contractual sources.
("Ada" / "Lovelace" / "the Countess" → one node), normalize and enrich. Fits research notes, brainstorming, exploratory reading.
be exact", "connect aggressively, this is ideation"`. Honor the intent, not a keyword.
The floor (always, regardless of stance): when you assert something the source didn't state outright, mark it — add {"inferred": true} (and a source snippet when useful) to that node/edge's properties. An inference is always visible and revertible, never laundered into a stated fact. This isn't a stance choice; it's the one non-negotiable.
kg --ontology NAME revert <event-id> away. Compose confidently, then review.
or surface what you'd have to add.
domains, ask whether to split into two ontologies rather than blending them.
person:Ada vsperson:ada-lovelace) — breaks cross-document dedup.
literal stance.name instead of extracting the entity.kg_node_upsert/kg node add calls —when a single kg_import (MCP) or kg import (CLI) does the whole batch in one gated, logged, atomic transaction. This is the most common mistake; don't.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.