graph-db-writes

A set of rules for writing project data to a Neo4j graph in RedAmon, a security-reconnaissance application. It explains which records need project and user identifiers, where graph-writing methods belong, and which schema locations must change together.

In plain words
What is it for?
Use it when adding or changing Cypher that writes findings, nodes, relationships, or properties, especially in graph database mixins or tools that save scan results.
Why use it?
It prevents data from different projects being silently merged and avoids overwriting information owned by another tool. It also keeps shared reference records, such as CVEs, from being incorrectly duplicated per project.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/samugit83/redamon/graph-db-writes
Any agent
npx skills add samugit83/redamon --skill graph-db-writes
Clone the repo
git clone --depth 1 https://github.com/samugit83/redamon

Made for: Claude Code, Codex.

Per session 119 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,306 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00119 $0.01306
Opus 5 $0.00060 $0.00653
Sonnet 5 $0.00024 $0.00261
Haiku 4.5 $0.00012 $0.00131

Measured 3d ago against content hash 8e46418748b0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

graph-db-writes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/graph-db-writes/SKILL.md · 93 lines

How it starts

The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.

When to Use

  • Adding or changing any Cypher that writes nodes/relationships/properties, in a graph_db mixin or a scan tool that persists to the graph.

For placing a whole new recon tool (which includes its graph write), use recon-tool-integration; this skill is the graph-write rules it depends on.


Critical Rules

  • NEVER add the tenant key to a reference node, and NEVER omit it from an entity node. Entity nodes (per-project findings) MERGE on {<natural_key>, user_id, project_id} - the tenant-isolation triple. A MERGE missing user_id/project_id merges one project's data into another's, silently. Global reference nodes (e.g. CVE) key on their natural id only (MERGE (c:CVE {id: $cve_id})); adding tenant keys there fragments shared data.
  • NEVER edit graph_db/neo4j_client.py directly. It is a thin orchestrator that combines the mixins by inheritance. Graph methods live in the mixin for their domain (see the table below).
  • NEVER unconditionally SET a field another tool owns. Use ON CREATE SET for provenance/first-writer fields (e.g. source) so a later tool merging the same node does not clobber them; use plain SET only for this tool's own enrichment fields. Reference: graph_db/mixins/graphql_mixin.py:189.
  • NEVER collect a field in a tool and not write it to the graph. Every field in the tool's output dict must land on a node property or relationship, or it is silent data loss. If it fits no node, map it to the closest property or say why it is dropped.
  • ALWAYS reuse an existing node label before inventing one. Discovered hostnames are Subdomain, not a new label. Check docs/readmes/GRAPH.SCHEMA.md first.
  • ALWAYS sync the schema when you add a label / relationship / property. Update docs/readmes/GRAPH.SCHEMA.md, the TEXT_TO_CYPHER_SYSTEM prompt at agentic/prompts/base.py:1451 (or the agent generates wrong Cypher and cannot see the new data), and NODE_COLORS in webapp/src/app/graph/config/colors.ts.

Read the full file on GitHub · 93 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 93 lines · 119 tokens per session scan A 8e46418748b0

Subscribe to this mod's changes

graph-db-writes is a skill published in the GitHub repository samugit83/redamon (2,372 stars, last pushed 2d ago), licensed MIT. It adds 119 tokens to every session and 1,306 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

bloodhound-query

BloodHound ingestion + canonical Cypher queries for AD attack-path enumeration. Run after collector dumps zip; promotes findings into the knowledge graph.

PurpleAILAB/Decepticon · 32 tokens

prisma-postgres-setup

Set up a new Prisma Postgres database and connect it to a local project using the Management API. Use when asked to "set up a database", "create a Prisma Postgres project", "get a connection string", "connect my app to Prisma Postgres", or "provision a database".

nitrocloudofficial/nitrostack · 67 tokens

prisma-upgrade-v7

Complete migration guide from Prisma ORM v6 to v7 covering all breaking changes. Use when upgrading Prisma versions, encountering v7 errors, or migrating existing projects. Triggers on "upgrade to prisma 7", "prisma 7 migration", "prisma-client generator", "driver adapter required".

nitrocloudofficial/nitrostack · 67 tokens

prisma-cli

Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, studio, validate, format, debug, and mcp. Use for ORM/database CLI workflows, not Prisma Compute app deployment. For Prisma Compute, @prisma/cli app deploy, compute:deploy, create-prisma --deploy, apps, deployments, logs, or domains, use the…

nitrocloudofficial/nitrostack · 125 tokens

prisma-client-api

Prisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".

nitrocloudofficial/nitrostack · 64 tokens

prisma-postgres

Prisma Postgres setup and operations guidance across Console, create-db CLI, Management API, and Management API SDK. Use when creating Prisma Postgres databases, working in Prisma Console, provisioning with create-db/create-pg/create-postgres, or integrating programmatic provisioning with service tokens or OAuth.

nitrocloudofficial/nitrostack · 63 tokens