registry / imhcode / 1.0.9

imhcode@1.0.9

IMH-Code — Imam Hussain Coding Harness Platform. A fast-first multi-agent AI coding framework with intelligent model routing. 19 generic role-based agents (planner, nextjs-executor, laravel-executor, etc.), configurable testing strategy, and 7 token-savin

AI Security Review

scanned 15m ago · by lpm-firewall-ai

The package is an AI-agent orchestration CLI that, when initialized, globally plants package-supplied rules and skills into multiple assistant home directories and modifies shell PATH files. It also can launch coding assistants with permission bypass flags during user-invoked live runs.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the imhcode CLI init flow or imhcode agent run ... --live

Impact

Broad assistant behavior can be changed outside the current project and live agent runs may execute with reduced approval/sandbox protections.

Mechanism

global AI-agent config mutation and permission-bypass agent launching

Attack narrative

On explicit CLI initialization, imhcode copies its bundled agent instructions and skills into broad home-level assistant directories for Claude, Gemini/Antigravity, and Copilot, replaces ~/.imhcode content, creates global shims, and may alter shell startup PATH. Later live agent execution can invoke opencode or codex with permission bypass flags. This is a real agent control-surface risk, but it is user-invoked rather than npm lifecycle/install-time execution.

Rationale

Source inspection confirms dangerous agent-facing global mutations and permission-bypass execution paths, but no npm install hook, import-time execution, credential theft, or exfiltration endpoint. Under the policy, this is warn-level because activation is explicit CLI use rather than unconsented lifecycle delivery.

Evidence

package.jsonbin/imhcode.jssrc/orchestrator/executor.tsdist/orchestrator/executor.jsAGENTS.mdCLAUDE.md~/.imhcode/~/.claude/CLAUDE.md~/.claude/AGENTS.md~/.claude/skills/~/.gemini/CLAUDE.md~/.gemini/AGENTS.md~/.gemini/skills/~/.copilot/CLAUDE.md~/.copilot/AGENTS.md~/.copilot/skills/~/.local/bin/imhcode~/.zshrc~/.bashrc~/.bash_profile~/.profiledocs/start.md

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

bin/imhcode.js default init copies package CLAUDE.md/AGENTS.md/skills into ~/.claude, ~/.gemini, and ~/.copilot
bin/imhcode.js default init rewrites ~/.imhcode and installs shims under ~/.imhcode/bin and ~/.local/bin
bin/imhcode.js appends IMH-Code PATH entries to shell startup files when present
bin/imhcode.js ensureCavemanAndGraphify may run npm install -g skills and npx skills add juliusbrussee/caveman during init
src/orchestrator/executor.ts runs opencode with --dangerously-skip-permissions and codex with --dangerously-bypass-approvals-and-sandbox for live agent execution

Evidence against

package.json has no npm lifecycle hooks, so behavior is not install-time triggered
Dangerous operations are reached through explicit CLI commands such as imhcode init/agent run --live, not import-time execution
No credential harvesting or direct exfiltration logic found in inspected entrypoints
Network use is package-aligned CLI/tool installation or local assistant CLI invocation, not a hardcoded exfil endpoint

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 57 file(s), 426 KB of source, external domains: api.github.com, example.com, fonts.google.com, github.com, raw.githubusercontent.com, www.typeui.sh

Source & flagged code

22 flagged

skills/typeui-main/src/prompts/designSystem.tsView file

Lines 1-38typescript

1type InquirerModule = typeof import("inquirer");

2import {

3 DesignSystemSchema,

4 ProviderSelectionSchema,

5 SkillMetadataSchema

6} from "../domain/designSystemSchema";

7import {

8 ALWAYS_INCLUDED_PROVIDERS,

9 DesignSystemField,

10 DesignSystemInput,

11 OPTIONAL_PROVIDERS,

12 PROVIDER_DETAILS,

13 Provider,

14 SkillMetadata,

15 SUPPORTED_PROVIDERS

16} from "../types";

18async function loadInquirer(): Promise<InquirerModule["default"]> {

19 const dynamicImport = new Function(

20 "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

skills/typeui-main/src/prompts/designSystem.tsView on unpkg · L18

21 "return import(specifier)"

22 ) as (specifier: string) => Promise<InquirerModule>;

23 const inquirerModule = await dynamicImport("inquirer");

24 return inquirerModule.default;

25}

27async function prompt<T>(questions: unknown): Promise<T> {

28 const inquirer = await loadInquirer();

29 return (await inquirer.prompt(questions as never)) as T;

30}

32const providerChoices: { name: string; value: Provider }[] = OPTIONAL_PROVIDERS.map((provider) => ({

33 name: `${PROVIDER_DETAILS[provider].title} (${PROVIDER_DETAILS[provider].relativePath.replace("/design-system/SKILL.md", "/")})`,

34 value: provider

35}));

37const UNIVERSAL_DEFAULT_AGENT_LIST = [

38 "Amp",

bin/imhcode.jsView file

Lines 2-44javascript

3/**

4 * IMH-Code CLI — Imam Hussain Coding Harness Platform

5 *

6 * Usage:

7 * imhcode → Initialize framework in current directory

8 * imhcode plan → Smart: brainstorm (LLM) OR sprint-plan (LLM) based on state

9 * imhcode execute [N] → Execute sprint N with intelligent model routing

10 * imhcode test → Run the testing/security/SEO sprint

11 * imhcode report → Generate PROJECT_REPORT.md for the team

12 * imhcode agent list → List all discovered agents

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView file

•path = skills/ui-ux-pro-max/.[redacted].py kind = payload_in_excluded_dir sizeBytes = 19430 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView on unpkg

•path = skills/ui-ux-pro-max/.[redacted].py kind = build_helper sizeBytes = 19430 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/graphify/skill-windows.mdView file

Lines 661-701markdown

661'@ | Out-File -FilePath graphify-out\.graphify_step_7_neo4j_export_only_if_neo4j_or__13.py -Encoding utf8

662& (Get-Content graphify-out\.graphify_python) graphify-out\.graphify_step_7_neo4j_export_only_if_neo4j_or__13.py

663Remove-Item -ErrorAction SilentlyContinue graphify-out\.graphify_step_7_neo4j_export_only_if_neo4j_or__13.py

664```

665

666**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

667

668```powershell

669@'

skills/graphify/skill-trae.mdView file

Lines 572-612markdown

572to_cypher(G, 'graphify-out/cypher.txt')

573print('cypher.txt written - import with: cypher-shell < graphify-out/cypher.txt')

574"

575```

576

577**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

578

579```bash

580$(cat .graphify_python) -c "

581import sys, json

582from graphify.build import build_from_json

583from graphify.cluster import cluster

skills/graphify/skill-pi.mdView file

Lines 523-563markdown

523to_cypher(G, 'graphify-out/cypher.txt')

524print('cypher.txt written - import with: cypher-shell < graphify-out/cypher.txt')

525"

526```

527

528**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

529

530```bash

531$(cat .graphify_python) -c "

532import sys, json

533from graphify.build import build_from_json

534from graphify.cluster import cluster

skills/graphify/skill-codex.mdView file

605patternName = generic_password severity = medium line = 605 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-codex.md

skills/graphify/skill-codex.mdView on unpkg · L605

skills/graphify/skill-kiro.mdView file

543patternName = generic_password severity = medium line = 543 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-kiro.md

skills/graphify/skill-kiro.mdView on unpkg · L543

skills/graphify/skill-copilot.mdView file

603patternName = generic_password severity = medium line = 603 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-copilot.md

skills/graphify/skill-copilot.mdView on unpkg · L603

skills/graphify/skill-opencode.mdView file

655patternName = generic_password severity = medium line = 655 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-opencode.md

skills/graphify/skill-opencode.mdView on unpkg · L655

skills/graphify/skill-aider.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-aider.md

skills/graphify/skill-aider.mdView on unpkg · L544

skills/graphify/skill-claw.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-claw.md

skills/graphify/skill-claw.mdView on unpkg · L544

skills/graphify/skill-droid.mdView file

600patternName = generic_password severity = medium line = 600 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-droid.md

skills/graphify/skill-droid.mdView on unpkg · L600

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126

Source & flagged code

22 flagged · loading source

skills/typeui-main/src/prompts/designSystem.tsView file

18async function loadInquirer(): Promise<InquirerModule["default"]> { L19: const dynamicImport = new Function( L20: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

skills/typeui-main/src/prompts/designSystem.tsView on unpkg · L18

bin/imhcode.jsView file

24const path = require('path'); L25: const { execSync, spawnSync } = require('child_process'); L26: const os = require('os'); ... L36: const CONFIG_FILE = path.join(LOCAL_DIR_NAME, 'imhcode.config.json'); L37: const GLOBAL_DIR = path.join(os.homedir(), '.imhcode'); L38: const START_MD = path.join(DOCS_DIR, 'start.md'); ... L49: if (command === '--version' || command === '-v') { L50: const pkg = require(path.join(__dirname, '..', 'package.json')); L51: console.log(`${CLI_CMD} version: ${pkg.version}`); ... L483: # 3. Run development server L484: ${stack.includes('Next.js') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''} L485: ${stack.includes('Vue 3 / Nuxt 4') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''}

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/imhcode.jsView on unpkg · L24

24Trigger-reachable chain: manifest.bin -> bin/imhcode.js L24: const path = require('path'); L25: const { execSync, spawnSync } = require('child_process'); L26: const os = require('os'); ... L36: const CONFIG_FILE = path.join(LOCAL_DIR_NAME, 'imhcode.config.json'); L37: const GLOBAL_DIR = path.join(os.homedir(), '.imhcode'); L38: const START_MD = path.join(DOCS_DIR, 'start.md'); ... L49: if (command === '--version' || command === '-v') { L50: const pkg = require(path.join(__dirname, '..', 'package.json')); L51: console.log(`${CLI_CMD} version: ${pkg.version}`); ... L483: # 3. Run development server L484: ${stack.includes('Next.js') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''} L485: ${stack.includes('Vue 3 / Nuxt 4') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''}

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/imhcode.jsView on unpkg · L24

•matchType = previous_version_dangerous_delta matchedPackage = imhcode@1.0.0 matchedIdentity = npm:aW1oY29kZQ:1.0.0 similarity = 0.877 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/imhcode.jsView on unpkg

24Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: sensitive-file+network, execution+network L24: const path = require('path'); L25: const { execSync, spawnSync } = require('child_process'); L26: const os = require('os'); ... L36: const CONFIG_FILE = path.join(LOCAL_DIR_NAME, 'imhcode.config.json'); L37: const GLOBAL_DIR = path.join(os.homedir(), '.imhcode'); L38: const START_MD = path.join(DOCS_DIR, 'start.md'); ... L49: if (command === '--version' || command === '-v') { L50: const pkg = require(path.join(__dirname, '..', 'package.json')); L51: console.log(`${CLI_CMD} version: ${pkg.version}`); ... L483: # 3. Run development server L484: ${stack.includes('Next.js') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''} L485: ${stack.includes('Vue 3 / Nuxt 4') ? 'cd frontend && npm run dev # → http://localhost:3000' : ''}

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/imhcode.jsView on unpkg · L24

22L23: const fs = require('fs'); L24: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/imhcode.jsView on unpkg · L22

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView file

•path = skills/ui-ux-pro-max/.[redacted].py kind = payload_in_excluded_dir sizeBytes = 19430 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView on unpkg

•path = skills/ui-ux-pro-max/.[redacted].py kind = build_helper sizeBytes = 19430 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/graphify/skill-windows.mdView file

681patternName = generic_password severity = medium line = 681 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-windows.md

skills/graphify/skill-windows.mdView on unpkg · L681

skills/graphify/skill-trae.mdView file

592patternName = generic_password severity = medium line = 592 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-trae.md

skills/graphify/skill-trae.mdView on unpkg · L592

skills/graphify/skill-pi.mdView file

543patternName = generic_password severity = medium line = 543 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-pi.md

skills/graphify/skill-pi.mdView on unpkg · L543

skills/graphify/skill-codex.mdView file

605patternName = generic_password severity = medium line = 605 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-codex.md

skills/graphify/skill-codex.mdView on unpkg · L605

skills/graphify/skill-kiro.mdView file

543patternName = generic_password severity = medium line = 543 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-kiro.md

skills/graphify/skill-kiro.mdView on unpkg · L543

skills/graphify/skill-copilot.mdView file

603patternName = generic_password severity = medium line = 603 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-copilot.md

skills/graphify/skill-copilot.mdView on unpkg · L603

skills/graphify/skill-opencode.mdView file

655patternName = generic_password severity = medium line = 655 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-opencode.md

skills/graphify/skill-opencode.mdView on unpkg · L655

skills/graphify/skill-aider.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-aider.md

skills/graphify/skill-aider.mdView on unpkg · L544

skills/graphify/skill-claw.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-claw.md

skills/graphify/skill-claw.mdView on unpkg · L544

skills/graphify/skill-droid.mdView file

600patternName = generic_password severity = medium line = 600 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-droid.md

skills/graphify/skill-droid.mdView on unpkg · L600

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126

Findings

3 Critical3 High17 Medium5 Low

CriticalPersistence Backdoorbin/imhcode.js

CriticalTrigger Reachable Dangerous Capabilitybin/imhcode.js

CriticalPrevious Version Dangerous Deltabin/imhcode.js

HighEntrypoint Build Divergencebin/imhcode.js

HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf

HighPayload In Excluded Dirskills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.py

MediumDynamic Requirebin/imhcode.js

MediumNetwork

MediumShips Build Helperskills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.py

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/graphify/skill-windows.md

MediumSecret Patternskills/graphify/skill-trae.md

MediumSecret Patternskills/graphify/skill-pi.md

MediumSecret Patternskills/graphify/skill-codex.md

MediumSecret Patternskills/graphify/skill-kiro.md

MediumSecret Patternskills/graphify/skill-copilot.md

MediumSecret Patternskills/graphify/skill-opencode.md

MediumSecret Patternskills/graphify/skill-aider.md

MediumSecret Patternskills/graphify/skill-claw.md

MediumSecret Patternskills/graphify/skill-droid.md

MediumSecret Patternskills/django-tdd/SKILL.md

LowScripts Present

LowEvalskills/typeui-main/src/prompts/designSystem.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

22 flagged

skills/typeui-main/src/prompts/designSystem.tsView file

Lines 1-38typescript

1type InquirerModule = typeof import("inquirer");

2import {

3 DesignSystemSchema,

4 ProviderSelectionSchema,

5 SkillMetadataSchema

6} from "../domain/designSystemSchema";

7import {

8 ALWAYS_INCLUDED_PROVIDERS,

9 DesignSystemField,

10 DesignSystemInput,

11 OPTIONAL_PROVIDERS,

12 PROVIDER_DETAILS,

13 Provider,

14 SkillMetadata,

15 SUPPORTED_PROVIDERS

16} from "../types";

18async function loadInquirer(): Promise<InquirerModule["default"]> {

19 const dynamicImport = new Function(

20 "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

skills/typeui-main/src/prompts/designSystem.tsView on unpkg · L18

21 "return import(specifier)"

22 ) as (specifier: string) => Promise<InquirerModule>;

23 const inquirerModule = await dynamicImport("inquirer");

24 return inquirerModule.default;

25}

27async function prompt<T>(questions: unknown): Promise<T> {

28 const inquirer = await loadInquirer();

29 return (await inquirer.prompt(questions as never)) as T;

30}

32const providerChoices: { name: string; value: Provider }[] = OPTIONAL_PROVIDERS.map((provider) => ({

33 name: `${PROVIDER_DETAILS[provider].title} (${PROVIDER_DETAILS[provider].relativePath.replace("/design-system/SKILL.md", "/")})`,

34 value: provider

35}));

37const UNIVERSAL_DEFAULT_AGENT_LIST = [

38 "Amp",

bin/imhcode.jsView file

Lines 2-44javascript

3/**

4 * IMH-Code CLI — Imam Hussain Coding Harness Platform

5 *

6 * Usage:

7 * imhcode → Initialize framework in current directory

8 * imhcode plan → Smart: brainstorm (LLM) OR sprint-plan (LLM) based on state

9 * imhcode execute [N] → Execute sprint N with intelligent model routing

10 * imhcode test → Run the testing/security/SEO sprint

11 * imhcode report → Generate PROJECT_REPORT.md for the team

12 * imhcode agent list → List all discovered agents

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView file

•path = skills/ui-ux-pro-max/.[redacted].py kind = payload_in_excluded_dir sizeBytes = 19430 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView on unpkg

•path = skills/ui-ux-pro-max/.[redacted].py kind = build_helper sizeBytes = 19430 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/ui-ux-pro-max/.claude/skills/design/scripts/cip/generate.pyView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/graphify/skill-windows.mdView file

Lines 661-701markdown

661'@ | Out-File -FilePath graphify-out\.graphify_step_7_neo4j_export_only_if_neo4j_or__13.py -Encoding utf8

662& (Get-Content graphify-out\.graphify_python) graphify-out\.graphify_step_7_neo4j_export_only_if_neo4j_or__13.py

663Remove-Item -ErrorAction SilentlyContinue graphify-out\.graphify_step_7_neo4j_export_only_if_neo4j_or__13.py

664```

665

666**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

667

668```powershell

669@'

skills/graphify/skill-trae.mdView file

Lines 572-612markdown

572to_cypher(G, 'graphify-out/cypher.txt')

573print('cypher.txt written - import with: cypher-shell < graphify-out/cypher.txt')

574"

575```

576

577**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

578

579```bash

580$(cat .graphify_python) -c "

581import sys, json

582from graphify.build import build_from_json

583from graphify.cluster import cluster

skills/graphify/skill-pi.mdView file

Lines 523-563markdown

523to_cypher(G, 'graphify-out/cypher.txt')

524print('cypher.txt written - import with: cypher-shell < graphify-out/cypher.txt')

525"

526```

527

528**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

529

530```bash

531$(cat .graphify_python) -c "

532import sys, json

533from graphify.build import build_from_json

534from graphify.cluster import cluster

skills/graphify/skill-codex.mdView file

605patternName = generic_password severity = medium line = 605 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-codex.md

skills/graphify/skill-codex.mdView on unpkg · L605

skills/graphify/skill-kiro.mdView file

543patternName = generic_password severity = medium line = 543 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-kiro.md

skills/graphify/skill-kiro.mdView on unpkg · L543

skills/graphify/skill-copilot.mdView file

603patternName = generic_password severity = medium line = 603 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-copilot.md

skills/graphify/skill-copilot.mdView on unpkg · L603

skills/graphify/skill-opencode.mdView file

655patternName = generic_password severity = medium line = 655 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-opencode.md

skills/graphify/skill-opencode.mdView on unpkg · L655

skills/graphify/skill-aider.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-aider.md

skills/graphify/skill-aider.mdView on unpkg · L544

skills/graphify/skill-claw.mdView file

544patternName = generic_password severity = medium line = 544 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-claw.md

skills/graphify/skill-claw.mdView on unpkg · L544

skills/graphify/skill-droid.mdView file

600patternName = generic_password severity = medium line = 600 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in skills/graphify/skill-droid.md

skills/graphify/skill-droid.mdView on unpkg · L600

skills/django-tdd/SKILL.mdView file

25patternName = generic_password severity = medium line = 25 matchedText = user = U...23')

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L25

117patternName = generic_password severity = medium line = 117 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L117

126patternName = generic_password severity = medium line = 126 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/django-tdd/SKILL.md

skills/django-tdd/SKILL.mdView on unpkg · L126