falkor-graph 96/100 — SaferSkills

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/falkor-graph/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/falkor-graph/SKILL.md· markdown

43- Do not use FalkorDB to edit canonical node fields.

44- Do not mutate inferred PPV relationships such as `HAS_IDENTITY`, `HAS_PILLAR`, or `PILLAR_

… (18 chars elided on L44)

45- Do not ask for raw credentials; the MCP server should already have them through env vars.

46- Do not run mutation Cypher through `falkor_graph_query`.

47- Keep graph writes narrow, explainable, and reversible.

Occurrences

1 occurrence · at L45

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/falkor-graph/SKILL.md · 1 file

skills/falkor-graph/SKILL.md3.1 KB · Markdown

name: falkor-graph

description: Use when the user asks for FalkorDB, Cypher graph traversal, graph schema inspection, or agent-owned PPV relationship links over visions, pillars, identities, and projects.

Use the LifeOS FalkorDB sidecar graph. This skill is for graph traversal and agent-owned relationship links, not canonical entity edits.

Use the LifeOS MCP tools:

Call falkor_graph_schema first.

Confirm FalkorDB is configured.
Review allowed node labels, relationship types, fields, query recipes, and link flow.
Treat this as the contract for the Falkor sidecar.

Use falkor_graph_query for read-only Cypher.

Allowed query shapes are read-only MATCH, WITH, RETURN, EXPLAIN, and PROFILE.
Every MATCH or WITH query must include LIMIT unless it is a count aggregate.
Prefer the query recipes returned by falkor_graph_schema before inventing raw Cypher.
Prefer projected fields (convexId, title, status, visionId, kind, reason, confidence) over returning whole nodes.
Prefer small, targeted traversals over whole-graph scans.

Use falkor_graph_link when a meaningful relationship exists but is not already represented.

Link only existing nodes.
Use exact node labels and convexId values from prior reads.
Include kind, reason, and confidence.
This writes only AGENT_LINK relationships.

Use falkor_graph_unlink only for relationships previously created by falkor_graph_link.

Good uses:

Trace PPV vision -> pillars -> projects.
Inspect PPV graph neighborhoods with Cypher.
Link a pillar, project, identity, or vision with agent-owned rationale.
Explain why a project matters by traversing project -> pillar -> vision.
Audit existing AGENT_LINK relationships before adding new ones.
Compare Falkor graph output with Convex graph projections.
Inspect whether a relationship already exists before creating it.

Rules:

Convex remains canonical for entity data.
Fears, inversions, and limiting-belief friction records are Convex life_beliefReframes records. Use get_belief_reframes, create_belief_reframe, and update_belief_reframe for those records; do not model them as Falkor AGENT_LINKs.
For unified graph questions that need friction records, prefer get_active_vision_graph or get_project_graph because those projections include belief_reframe nodes.
convexId is the stable id shared between Convex and Falkor nodes.
Do not use FalkorDB to edit canonical node fields.
Do not mutate inferred PPV relationships such as HAS_IDENTITY, HAS_PILLAR, or PILLAR_SUPPORTS_PROJECT.
Do not ask for raw credentials; the MCP server should already have them through env vars.
Do not run mutation Cypher through falkor_graph_query.
Keep graph writes narrow, explainable, and reversible.

When reporting results:

Include the key nodes and relationships found.
Include any newly created AGENT_LINK relationship id.
Include the Cypher used when it helps future follow-up.
Say clearly when the Falkor sidecar is missing data and a Convex sync may be needed.

falkor-graph— agent skill

Is falkor-graph safe to install?

Audit the pieces. Scan the whole. Decide.