Install
$ agentstack add skill-bryanwhl-skill-graph-agent-skill ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
skill-graph
Use this skill when a task could benefit from specialized agent skills, especially work involving frontend polish, testing, documentation, deployment, security review, performance, or framework-specific implementation.
Runtime Loop
- Resolve the task before specialized work:
``bash skill-graph resolve "" --format markdown ``
- Load the selected shallow context first.
- Inspect the task and repository.
- Expand only nodes justified by new evidence:
``bash skill-graph expand --depth summary ``
- Expand to full context only when the summary is insufficient:
``bash skill-graph expand --depth full ``
- Ask before installing any remote skill.
- At the end, report which nodes were loaded and which frontier nodes were skipped.
Commands
skill-graph index: scan local skill roots and write.skill-graph/index.json.skill-graph index --skills-sh-query "": include not-installed skills.sh candidates in the graph for the current domain.skill-graph remote-cache "": cache skills.sh candidates and show approval-required install commands.skill-graph embeddings index: build a local semantic embedding index. Use the defaultqwen3-localprovider only when local Python dependencies and model storage are acceptable; use--provider deterministicfor tests and demos.skill-graph embeddings index --trust-remote-code: allow model repository code execution only after explicit human review of the model source.skill-graph embeddings info: show the saved local embedding provider, model, dimensions, and vector count.skill-graph edges suggest: propose inferred edges from embedding similarity for human review; do not treat proposed edges as canonical.skill-graph search "": search the local graph with BM25 by default; use--strategy lexicalfor baseline comparison,--strategy semanticafter embeddings exist, or--strategy hybridfor BM25 plus lexical plus semantic fusion.skill-graph resolve "": return selected nodes, context depths, frontier nodes, conflicts, missing nodes, scoring provider provenance, and reasons. Hybrid resolution includes semantic results only when a local embedding index already exists.skill-graph expand --depth: load deeper context for one node.skill-graph context: show context layers loaded in the current workspace.skill-graph explain --last: explain the last resolution path.skill-graph install: show the exact dry-run install command for a remote node when available.
Operating Rules
- Prefer installed local skills when they are good enough.
- Use ancestors at shallow depth.
- Use direct matches at the deepest useful depth allowed by budget.
- Keep complements on the frontier until the task requires them.
- Treat conflicts as warnings that need human review before loading both skills at full depth.
- Treat inferred edge suggestions as review items, not active resolver policy.
- Never install remote skills without explicit user approval.
- Treat remote-cache results as metadata only until the user approves an install.
- Do not enable any embedding provider that uploads local task, repository, or private skill text without explicit human approval.
- Do not pass
--trust-remote-codeunless the user explicitly accepts local execution of model repository code.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: bryanwhl
- Source: bryanwhl/skill-graph
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.