Graph Databases (Neo4j)

Reviewed 2026-10-13dataPrompt / Rule# graph-database # neo4j # cypher # graphrag # knowledge-graph

Neo4j's skill collection for graph databases: Cypher queries, graph modeling, imports, drivers, GraphRAG, vector indexes, GDS and Aura provisioning.

Security Reviewed

Medium risk by nature: mostly Markdown, with 8 offline-safe Python scripts, but the skills run queries and provision cloud resources with your credentials; the Cypher skill adds an EXPLAIN-first write gate.

Install Graph Databases (Neo4j) in Google Antigravity

Antigravity loads skills from .agents/skills/ in your project or ~/.gemini/config/skills/ for all projects (official docs). Full guide

EasiestOption 1: paste this to your Antigravity agent

Install the "Graph Databases (Neo4j)" skill for Google Antigravity.
Follow the steps at https://www.antigravityskills.org/install/graph-databases.md (source: https://github.com/neo4j-contrib/neo4j-skills).
Before running anything, show me what you will download and whether it includes scripts, and wait for my OK.
Install it into this project (.agents/skills/) unless I say global. When done, check that Antigravity lists it as an installed skill.

The agent reads the install file, shows you what it will download and waits for your OK.

Option 2: install it yourself

1. Option A: import as a plugin (documented)
```
agy plugin import gemini
```
Documented in the repository README for Antigravity CLI users migrating from Gemini CLI: it converts the gemini-extension.json manifest and copies the skills into .agents/skills/. It requires that you first installed the Gemini extension with `gemini extensions install https://github.com/neo4j-contrib/neo4j-skills`. Verify with /plugins list.
2. Option B: clone the repository
```
git clone --depth 1 https://github.com/neo4j-contrib/neo4j-skills /tmp/neo4j-skills
```
Clone to a temporary folder to copy individual skills.
3. Copy the skills you need into your workspace
```
mkdir -p .agents/skills && cp -r /tmp/neo4j-skills/neo4j-cypher-skill /tmp/neo4j-skills/neo4j-modeling-skill /tmp/neo4j-skills/neo4j-getting-started-skill .agents/skills/
```
Antigravity reads workspace skills from <project>/.agents/skills/<folder>/. Add other folders (for example neo4j-import-skill or neo4j-graphrag-skill) the same way; skills point to each other by name.

4. Or copy globally (all projects)

mkdir -p ~/.gemini/config/skills && cp -r /tmp/neo4j-skills/neo4j-cypher-skill /tmp/neo4j-skills/neo4j-modeling-skill /tmp/neo4j-skills/neo4j-getting-started-skill ~/.gemini/config/skills/

Antigravity reads global skills from ~/.gemini/config/skills/<folder>/.

5. Check that Antigravity sees them
Start a new session and ask "What skills do you have?" (in the Antigravity CLI you can also run /skills).

Set NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD and optionally NEO4J_DATABASE. Scripts need Python with the neo4j package. neo4j-getting-started-skill refers to ${CLAUDE_SKILL_DIR}; if your agent cannot find its stage files, give it the folder path. neo4j-cli-tools-skill recommends installing the Neo4j CLI with `curl -sSfL https://neo4j.sh/install.sh | bash`; review that script before running it. The README does not describe a manual Antigravity install; Option B uses Antigravity's standard skill folders.

Using Claude Code, Cursor or Codex? See other assistants below.

What is Graph Databases (Neo4j)?

neo4j-skills is Neo4j's skill collection for developers who want an AI agent to write Cypher, design graph models, load data and build GraphRAG apps against a Neo4j or Aura database. What we counted at commit e83483a (2026-10-13): 29 skill folders, each with a SKILL.md (504,808 bytes in total); 153 files across the skill folders, of which 142 are Markdown (83 of them reference files) and only 8 are Python scripts, all in three skills (neo4j-cypher-skill 3, neo4j-aura-agent-skill 4, neo4j-getting-started-skill 1), so 26 of the 29 skills ship no scripts. 27 of the 29 SKILL.md files declare allowed-tools Bash and WebFetch; the Cypher and agent-memory skills declare none. The README says the collection covers Cypher 25 queries, graph modeling, imports, drivers for Python, JavaScript, Java, .NET and Go, GraphRAG, vector indexes, Graph Data Science and Aura provisioning, and that connection details come from NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD and NEO4J_DATABASE. Unlike the single-tool data skills on this site (duckdb-cli, sqlite-mcp-server), it is a whole family of skills for one database, so you normally copy only the folders you need.

How to use Graph Databases (Neo4j)?

Install the collection, or copy only the folders you need, set the NEO4J_* variables, then ask for graph work in plain language. Per the Cypher SKILL.md, the agent inspects your schema first (it uses a <db-name>-schema.json file if one is in the project), writes Cypher 25 with a LIMIT on exploratory reads, and runs EXPLAIN before any write it executes, then waits for your confirmation. The getting-started skill runs an 8-stage pipeline (prerequisites, context, provision, model, load, explore, query, build) and records progress in progress.md; in its autonomous mode it skips every approval checkpoint.

Key features of Graph Databases (Neo4j)

✓neo4j-cypher-skill (v1.0.28): Cypher 25 for Neo4j 2025.01 or newer, schema-first protocol, EXPLAIN-before-write gate, LIMIT 25 default on exploratory reads
✓neo4j-modeling-skill and neo4j-migration-skill: graph model design and review, and 4.x/5.x to 2025.x driver and Cypher upgrades
✓neo4j-getting-started-skill: 8 stages from prerequisites to a running app, on Aura or Docker
✓Import skills: LOAD CSV, neo4j-admin import, the Data Importer GUI and document-to-graph extraction with SimpleKGPipeline (README)
✓AI and search skills: vector indexes, in-Cypher ai.text.* functions, GraphRAG retrievers, agent memory and the Neo4j MCP server
✓Driver skills for Python, JavaScript, Java, .NET and Go, plus GraphQL, Spring Data, Spark and Kafka skills
✓Graph Data Science, Aura Graph Analytics and Snowflake Graph Analytics skills

When to use Graph Databases (Neo4j)

1Write or debug a Cypher query against your own schema
2Design a graph model for a new project or migrate a relational one
3Load CSV or JSON data into Neo4j
4Build a GraphRAG retrieval pipeline
5Run graph algorithms such as PageRank or Louvain with GDS

Installation & Setup Guide

Agent Rules / Prompt Setup

Follow these steps (taken from the project's own docs) to configure Graph Databases (Neo4j) in your development environment.

Step 1: skills CLIclaude

npx skills add https://github.com/neo4j-contrib/neo4j-skills

Documented at the top of the README (it points to skills.sh/neo4j-contrib/neo4j-skills). The README does not say which agents this targets.

Step 2: Claude Code pluginclaude

/plugin marketplace add https://github.com/neo4j-contrib/neo4j-skills.git

Then run /plugin install neo4j-skills@neo4j-skills-marketplace and verify with /plugin list (README, Claude Code section).

Step 3: Gemini CLI extensiongemini

gemini extensions install https://github.com/neo4j-contrib/neo4j-skills

Enter your NEO4J_* values when prompted, then verify with /extensions list (README, Gemini CLI section).

Step 4: Cursor: not documentedcursor

The README has no Cursor section. The frontmatter of neo4j-getting-started-skill lists cursor under compatibility, but the project gives no Cursor install steps, so we do not list a command.

Usage Example & Verification

Prompt / Request Example

The README has no example prompts, so all three are ours.

1) Our example: "Using my Neo4j database, find the five people with the most KNOWS relationships and optimize the query."
-> What happens: per neo4j-cypher-skill/SKILL.md the agent reads <db>-schema.json or inspects the live schema first, writes a CYPHER 25 query with named return fields and a LIMIT, and uses EXPLAIN/PROFILE to look for AllNodesScan or CartesianProduct. A read-only query needs no write confirmation.

2) Our example: "Model this orders.csv as a graph and write the LOAD CSV import."
-> What happens: the modeling skill proposes nodes, relationships and properties, and the import skill (README: LOAD CSV, neo4j-admin import) drafts the import statements. Run any write yourself or approve it after the EXPLAIN step.

3) Our example: "Set up a new Neo4j project from scratch with a movies dataset."
-> What happens: neo4j-getting-started-skill works through its 8 stages and updates progress.md after each one. It pauses for your approval at each stage unless you run it in autonomous mode.

Installation Confirmation Method

Start a new session and ask "What skills do you have?" (Antigravity CLI: /skills). Then ask "Which Neo4j versions does neo4j-cypher-skill assume?" The answer should be Neo4j 2025.01 or newer with Cypher 25, which is the compatibility line in its frontmatter.

Security Review

Static review

Reviewed Date

2026-10-13

Audited Ref / Commit

e83483aa1a69d919469bfe7dcea54b0e5acf59f5

Reviewer

antigravityskills.org (static code review)

Full review: scope, findings, risks

Audit Scope:Static review at commit e83483a: README.md, NEO4J.md, LICENSE, gemini-extension.json, .agents/plugins/marketplace.json; neo4j-cypher-skill/SKILL.md (header, defaults, write gate, validation sections); neo4j-getting-started-skill/SKILL.md and references/0-prerequisites.md; all 8 skill scripts checked for imports, network calls, subprocess/eval/exec, environment variables and file writes; the allowed-tools line of all 29 SKILL.md files; grep of every skill folder for curl, wget, pip install, docker run and CLAUDE_SKILL_DIR. The other SKILL.md bodies and the 83 reference files were not read line by line.

Key Findings:Skill scripts: 8 Python files in 3 skills, none use subprocess, eval or exec. generate_schema.py and validate_queries.py read NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD and NEO4J_DATABASE, connect with the neo4j driver and write or read local files; fetch_schema.py does the same for the Aura agent skill. invoke_agent.py and manage_agent.py post to https://api.neo4j.io with AURA_CLIENT_ID and AURA_CLIENT_SECRET, and manage_agent.py can delete an agent. Several scripts load a .env file if python-dotenv is installed. Instruction text: 27 of 29 SKILL.md files declare Bash and WebFetch; neo4j-getting-started-skill also declares mcp__neo4j__write-cypher and Write/Edit. Its prerequisites download the neo4j-mcp binary from GitHub releases/latest with curl and chmod +x, create a .venv for pip installs and start Docker containers. neo4j-aura-provisioning-skill documents creating, resizing and deleting Aura instances (REST and aura-cli) and marks delete as irreversible. neo4j-cli-tools-skill recommends curl -sSfL https://neo4j.sh/install.sh | bash. In autonomous mode the getting-started skill skips all approval checkpoints.

Identified Operational Risks & Permissions:Agent-generated write queries can modify or delete graph data; database and Aura credentials are needed; Aura skills can create paid instances or delete one; one skill recommends a pipe-to-bash installer and another downloads a binary; autonomous mode removes the approval pauses. Static review only: we did not run the scripts or the skills.

Static review at commit e83483a. neo4j-cypher-skill/scripts/generate_schema.py reads NEO4J_URI, NEO4J_USERNAME, NEO4J_PASSWORD and NEO4J_DATABASE, connects with GraphDatabase.driver and writes <db>-schema.json; define_schema.py and import_neo4j_schema.py work on local JSON files only. neo4j-getting-started-skill/scripts/validate_queries.py connects the same way and reads a local CSV. neo4j-aura-agent-skill/scripts/fetch_schema.py connects to the database, while invoke_agent.py and manage_agent.py post to https://api.neo4j.io (BASE) with Aura client credentials; validate_eval_dataset.py works on local files. None of the 8 scripts imports subprocess or calls eval or exec (scripts/bump-version.py and scripts/lint_skills.py at the repository root use subprocess but are maintenance tooling outside the skill folders). neo4j-cypher-skill/SKILL.md requires EXPLAIN before an executed write, a LIMIT 1 test for new reads and confirmation before execution. neo4j-getting-started-skill declares allowed-tools Bash, WebFetch, Read, Write, Edit and Neo4j MCP read/write-cypher, downloads neo4j-mcp from github.com/neo4j/mcp releases/latest in references/0-prerequisites.md, and in autonomous mode skips every approval checkpoint. neo4j-aura-provisioning-skill/SKILL.md uses curl against api.neo4j.io, including DELETE /v1/instances/<id> marked IRREVERSIBLE. neo4j-cli-tools-skill/SKILL.md line 38 recommends curl -sSfL https://neo4j.sh/install.sh | bash.

Operational Notes & Known Limitations

Known Limitations

•Needs a running Neo4j database (Aura or local) and NEO4J_URI, NEO4J_USERNAME and NEO4J_PASSWORD for anything that runs queries
•neo4j-cypher-skill declares compatibility with Neo4j 2025.01 or newer (Cypher 25); older versions need the fallbacks listed in its Version Gates table
•The 8 scripts need Python with the neo4j driver (python-dotenv optional); the Aura agent scripts need requests plus AURA_CLIENT_ID and AURA_CLIENT_SECRET
•Only neo4j-getting-started-skill uses the Claude Code variable ${CLAUDE_SKILL_DIR} (24 occurrences, we counted); the repository does not say how Antigravity resolves it, so if the agent cannot find the stage files, tell it the folder path
•The README documents only agy plugin import gemini for Antigravity, and that route needs the Gemini extension installed first; the manual copy on this page uses Antigravity's standard skill folders
•In its autonomous mode neo4j-getting-started-skill auto-approves every decision and skips all approval checkpoints (SKILL.md), so keep it in the default human-in-the-loop mode on a database you care about
•Neo4j-specific: it does not cover other graph databases

Frequently Asked Questions

Are the Neo4j Agent Skills safe?

In our static review of commit e83483a, 26 of the 29 skills are Markdown only. The 8 Python scripts use no subprocess, eval or exec; three connect to your database with NEO4J_* variables and write schema JSON files, and the Aura agent scripts call https://api.neo4j.io with your Aura client credentials. Several SKILL.md files show curl calls, neo4j-cli-tools-skill recommends curl -sSfL https://neo4j.sh/install.sh | bash, and the Aura provisioning skill documents an irreversible instance delete. Write queries can change data, so review them.

How do I install the Neo4j skills in Antigravity?

The README documents agy plugin import gemini for Antigravity CLI users who already installed the Gemini extension; it copies the skills into .agents/skills/. Otherwise clone the repository and copy the folders you need into .agents/skills/ (project) or ~/.gemini/config/skills/ (global), then ask "What skills do you have?" (Antigravity CLI: /skills). You can also paste the one-line prompt above and let your agent do it.

Can I install only the Cypher skill?

Yes. Each skill is its own folder with its own SKILL.md; copy neo4j-cypher-skill alone if that is all you need. Skills point to each other by name (the Cypher skill refers to neo4j-migration-skill and neo4j-cli-tools-skill), so copy those too if you want the hand-offs.

Do I need Neo4j Aura?

No. NEO4J_URI can point to Aura (neo4j+s://...) or a local instance (neo4j://localhost:7687); the getting-started skill supports Aura or Docker.

Which Neo4j versions are supported?

neo4j-cypher-skill declares compatibility with Neo4j 2025.01 or newer and Cypher 25, with fallbacks for older versions. Other skills carry their own version notes in their SKILL.md.