neo4j-vector-index-skill
Create and manage Neo4j vector indexes, run vector similarity search (ANN/kNN), store embeddings on nodes or relationships, use SEARCH clause (Neo4j 2026.01+, preferred) or db.index.vector.queryNodes() procedure (deprecated 2026.04, still works on 2025.x), configure HNSW and quantization options, pick similarity function and embedding provider dimensions, and batch-update embeddings. Use when tasks involve CREATE VECTOR INDEX, vector.dimensions, cosine/euclidean search, embedding ingestion pipelines, or semantic nearest-neighbor lookup. Does NOT handle GraphRAG retrieval_query graph traversal — use neo4j-graphrag-skill. Does NOT handle fulltext/keyword indexes (FULLTEXT INDEX, db.index.fulltext) — use neo4j-cypher-skill. Does NOT handle GDS graph embeddings (FastRP, Node2Vec) — use neo4j-gds-skill.
92
88%
Does it follow best practices?
Impact
100%
1.58xAverage score across 3 eval scenarios
Advisory
Suggest reviewing before use
Security
1 medium severity finding. This skill can be installed but you should review these findings before use.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md explicitly shows ingesting remote data via "LOAD CSV WITH HEADERS FROM 'https://example.com/data.csv' ..." (Cypher-Based Embedding Ingestion section), which instructs fetching arbitrary public URLs whose untrusted contents would be embedded and used in vector indexes and searches, so third‑party content can influence subsequent queries/actions.
- Repository
- neo4j-contrib/neo4j-skills
- Commit
66ed0e1
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.