Graphify skill triggers ~30 Claude Code security prompts per run from inline python -c — how was it fixed?

4 answers

• Best answerAgentArmor teamTeam3d ago

  Status: fixed per the contributor's comment — the issue page still shows open in this snapshot, but the contributor says #4275 landed and verified the change. On 0.4.1, every step ran as $(cat graphify-out/.graphify_python) -c "…" with 10–20 lines of Python containing # comments; both Claude Code heuristics that fire on that are content-based and cannot be allowlisted, hence the ~30 prompts. An earlier fix (#114, v0.3.18) replaced only one inline save_query_result block with graphify save-result; all other steps and reference flows kept inline Python, which is what this issue tracked.

  The #4275 fix moved step bodies into graphify/pipeline.py and exposed them as graphify pipeline <step> subcommands: detect, extract-ast, empty-semantic, cache-check, merge-chunks, save-cache, merge-semantic, merge-extraction, build, diagnose, label, save-manifest, cleanup, plus vocab, transcribe, detect-incremental, code-only-check, empty-extract, update-merge, and graph-diff for the reference flows. References now call those plus existing commands (graphify query/path/explain/save-result/add/watch) and the graphify-mcp console script. The skill is generated from tools/skillgen/fragments/; fragments were edited and all artifacts regenerated with a drift guard that fails if an inline -c block reappears.

  Result: no $(cat …), no inline python -c, and Bash(graphify *) is allowlistable, so the ~30 prompts per run are gone. The contributor verified byte-identical .graphify_* sidecars, graph.json, manifest.json, and GRAPH_REPORT.md on a real corpus, with no new test failures. Until you upgrade, the only partial workaround from the thread is patching skill.md to use the literal interpreter path instead of $(cat …) — that removes the command-substitution prompt but not the quoted-argument one; broad settings.json allow-rules do not bypass these heuristics. Security note: after the fix, arguments go through argparse instead of string interpolation, which reduces injection risk, and Bash(graphify *) is scoped to what the CLI exposes.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @nothariharan tried on GitHub (Worked)

  Contributor fix in #4275: moved step bodies into graphify/pipeline.py exposed as graphify pipeline <step> subcommands, edited the skill fragments in tools/skillgen/fragments, regenerated all artifacts, and verified byte-identical output on a real corpus with no new test failures plus a drift guard against inline -c blocks.

  Source: https://github.com/Graphify-Labs/graphify/issues/197#issuecomment-6094458945 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What a GitHub user tried on GitHub (Partly worked)

  Patching skill.md locally to replace $(cat graphify-out/.graphify_python) with the literal interpreter path. Users report this avoids the command-substitution heuristic but not the newline-and-#-in-quoted-argument heuristic, so prompts remain.

  Source: https://github.com/Graphify-Labs/graphify/issues/197 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmor teamTeam3d ago

  What @biggates tried on GitHub (Partly worked)

  Pointing to the earlier fix in issue #114, which had replaced one inline save_query_result block with graphify save-result (v0.3.18). The comment notes that previous fix does not solve all of the remaining inline Python steps.

  Source: https://github.com/Graphify-Labs/graphify/issues/197#issuecomment-4256690773 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport