SKILL.md Step 1 writes literal INPUT_PATH into graphify-out/.graphify_root

[filipechagas]

What

graphify install --project generates .claude/skills/graphify/SKILL.md verbatim. In that generated file, the Step 1 — Ensure graphify is installed bash block ends with:

# Save scan root so `graphify update` (no args) knows where to look next time
echo "$(cd INPUT_PATH && pwd)" > graphify-out/.graphify_root

INPUT_PATH is a placeholder, but Step 1 carries no substitution instruction. The instruction "Replace INPUT_PATH with the actual path the user provided" appears only after the Step 2 block, and Steps 4/5/9 repeat it for themselves. An agent that follows the file literally runs cd INPUT_PATH, which fails, and — depending on shell — leaves graphify-out/.graphify_root empty or containing the literal string, so any later command that reads it to locate the scan root is wrong.

Expected

Step 1 states the same substitution rule the other steps do, e.g. immediately after the code block:

Replace INPUT_PATH on the last line with the actual path the user provided (. if none was given) — left as the literal placeholder, .graphify_root records the string INPUT_PATH instead of the scan root.

(An alternative fix, arguably better: have Step 1 write $(pwd) or resolve the path in the same Python one-liner that writes .graphify_python, so there is no placeholder to substitute at all.)

Where found

Flagged by an automated reviewer on lawnstarter/customer-platforms PR #14499 (Jira PE-80044), which installs this skill into the customer-platforms monorepo. The identical generated file ships into ~12 LawnStarter repos, so the fix belongs upstream in the generator rather than in each consuming repo. We applied the one-line doc fix locally in that PR as a stopgap.

Fork commit checked: 5e9d95c11837aeabbbb5d90cb45544f49dc58ca4 (branch v8, CLI reports 0.9.40).

[filipechagas]

Triage: canonical issue for the SKILL.md Step 1 work unit. #77 is closed into this issue: both defects live in the same generated fragment (tools/skillgen/fragments/shell/posix.md, mirrored in powershell.md) and one PR fixes both. Verified still present at v8 HEAD 4492f9f (git log 5e9d95c..HEAD -- graphify/skill.md is empty).

Folded in from #77:

• Step 1 executes whatever absolute-ish path appears in the console script's shebang, guarded only by a character-class filter — /usr/bin/perl and /tmp/a_b both pass and get executed with -c "import graphify". Narrow the case pattern to python-interpreter basenames. (Defense-in-depth; the accept/reject table in SKILL.md Step 1 executes the graphify binary's shebang behind a character-class filter only (PE-80046) #77 was reproduced in a live shell at HEAD and matches exactly.)
• com.lawnstarter.pros PR #14308 already carries this patch as local drift — the fix un-forks that repo.
• The uv tool run --from graphifyy fork-shadowing remark in SKILL.md Step 1 executes the graphify binary's shebang behind a character-class filter only (PE-80046) #77 is a design question, not a Step 1 code fix; note it in the PR, do not block on it.

Fix for this issue proper: either add the INPUT_PATH substitution instruction to Step 1, or eliminate the placeholder by writing .graphify_root from the same Python one-liner that writes .graphify_python. Regenerate every graphify/skill*.md variant and the tools/skillgen/expected/ goldens in the same commit (the skillgen parity check enforces this).