ripwire-graph-query SKILL.md skillA
ripwire-graph-query from redhat-et/ripwire is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add redhat-et/ripwire/ripwire-graph-query@git:20260913.30a5a3cPins git:20260913.30a5a3c in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- redhat-et/ripwire
- Path
skills/ripwire-graph-query/SKILL.md- Versions recorded
- 4
- Latest version
- git:20260913.30a5a3c, committed Sep 13, 2026
- First version recorded
- Jul 31, 2026
- Size
- 4,508 bytes
- Repository stars
- 2,530
- License
- Apache-2.0
A call-graph question the fixed verbs can't phrase — 'which high-complexity functions can reach X?', 'what has 10+ callers in src/?', 'untested symbols within one hop of main'. --graph-query: a small closed expression language — kind, complexity, fan-in, tested filters; a file or cluster; bounded hops; and/or/not.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Graph queries with ripwire > One-hop questions have cheaper verbs — **ripwire-navigate** (`--callers`, `--callees`, `--uses`, > `--path`, `--impact`). Reach for `--graph-query` only when you need to COMBINE conditions. > Repo-wide architecture health (not one query) → **ripwire-layers**. ## Planning a refactor: find the cluster AND its blast radius The refactor-planning question is always two conditions at once — "what's messy" AND "what would touching it affect" — which is exactly what a single fixed verb can't phrase: ``` # the refactor short-list: high-complexity functions in the target area ripwire <dir> --graph-query='and(cx(all,15),file(all,"src/"))' --legend=compact # now the blast radius: everyone who transitively calls into that cluster (≤3 hops) ripwire <dir> --graph-query='callers(and(cx(all,15),file(all,"src/")),3)' --legend=compact ``` (Verified on this repo's shape, not its exact numbers — `count=` drifts every commit: the first query returns the high-cx symbols under `src/`, each `<s t= n= p=>` (kind/name/path); the second returns the transitive caller set, typically smaller than the cluster itself because many hits are leaf-ish or call each other. Read …
Read the whole file at its exact version.
How to install
mdr add redhat-et/ripwire/ripwire-graph-query@sha256:b219b0318a5e020eThe line at the top of this page pins the label git:20260913.30a5a3c, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_utvzaulyrhfwhaut)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Jul 31, 2026 and Sep 13, 2026, about one every 14 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260913.30a5a3c latest | 2026-09-13 | 30a5a3c | 4,508 B | A | view · diff |
| git:20260907.9e1e9f9 | 2026-09-07 | 9e1e9f9 | 4,355 B | A | view · diff |
| git:20260810.cc63a3b | 2026-08-10 | cc63a3b | 4,503 B | A | view · diff |
| git:20260731.3315fb1 | 2026-07-31 | 3315fb1 | 4,471 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4508 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
redhat-et/ripwire · 2,530 stars · license Apache-2.0 · pushed 2026-11-07 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_utvzaulyrhfwhaut GET https://markdownregistry.com/api/v1/resolve?ref=redhat-et/ripwire/ripwire-graph-query GET https://markdownregistry.com/api/v1/blob/b219b0318a5e020ecf8cfaf9daeed1fa95631218bb572c5f7bc587aeda080e54
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.