Security review: destructive deletes + never-ask autonomy + unpinned remote run in the skill (chain-confirmed) #5182

Hi, sorry if my words seem a bit off — I'm just a normal user and a follower of your work, not a dev, and I'm definitely not here with any attitude or to act superior. I ran a security scanner over a local copy of the graphify skill for my own setup, and I found a couple of things worth mentioning. Just letting you know, and if anything I say comes across as offensive, I'm sorry.

What I ran: SkillSpector five times (static scan, no LLM), score 100, CRITICAL, 13 issues, coverage 88.9% (one component uninspected) — and all five runs produced exactly the same 13 flags, so this isn't scanner noise. The items below are the ones that stayed real across the chain.

1. Destructive deletes in the skill's own instructions — rm -f graphify-out/.graphify_cached.json (SKILL.md:369), rm -f graphify-out/.graphify_detect.json (SKILL.md:645), rm -f graphify-out/.needs_update (SKILL.md:647), and rm -f graphify-out/.graphify_old.json (references/update.md:209). The skill tells the agent to delete files. They're scoped to its own graphify-out/ cache dir, so it's not deleting user files — but an agent following these instructions runs rm -f without asking.

2. Never-ask autonomy — SKILL.md:53, :55 ("Do not ask the user"), SKILL.md:165 ("Never ask the user"), references/add-watch.md:27 ("automatically run"). The skill instructs the agent to act without confirming with the user, including around the deletes above.

3. Unpinned remote run — uv tool run --from graphifyy (SKILL.md:73, :89) with no version pinned. A future bad publish would flow straight into installs.

4. Coverage gap — references/exports.md was only partially inspected (the scanner flags it as an incomplete referenced artifact), so one part of the skill wasn't fully checked.

What I'd suggest: pin the uv tool run version, add a confirmation step before the rm -f deletes (or at least scope them explicitly and say why they're safe), and soften the never-ask wording so the agent asks before destructive operations. The rest of the skill reads fine to me — it's these spots that deserve the edit. I'm happy to share the full scanner output if it's useful.

No rush on any of this, and thank you for building the tool — it's genuinely useful.