Ralph Loop (Agent Mode)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:32 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed automation guide, but it gives agents broad command-execution patterns that can run coding tools with reduced safeguards and includes risky rollback guidance.

Install only if you want an agent to run and monitor other coding agents in your project. Use a sandbox or isolated worktree, avoid --yolo and --dangerously-skip-permissions, validate any CLI/model/flag values before execution, and do not approve git reset --hard unless you have backed up or reviewed the repository state.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58

Finding

Shell Command Injection Through Unvalidated CLI Configuration

Content

View full analysis

\"$(cat PROMPT.md)\"" - workdir: - background: true - pty: true - yieldMs: 60000 - timeout: 3600 ``` The related command templates and optional flags include: ```text | **OpenCode** | `opencode run --model "$(cat PROMPT.md)"` | | **Codex** | `codex exec "$(cat PROMPT.md)"` (requires git) | | **Claude Code** | `claude "$(cat PROMPT.md)"` | | **Pi** | `pi --provider --model -p "$(cat PROMPT.md)"` | | **Goose** | `goose run "$(cat PROMPT.md)"` | Common flags: - Codex: `--full-auto`, `--yolo`, `--model ` - Claude: `--dangerously-skip-permissions` ``` ### Technical Analysis The Skill instructs an agent to collect CLI, model, provider, flag, and working-directory values and interpolate them into a shell command string. It does not require strict allowlisting, shell-safe argument handling, structured executable/argument arrays, or rejection of shell metacharacters. If an attacker can influence a value substituted for ``, ``, ``, or a custom CLI command, shell syntax embedded in that value may terminate or alter the intended command and append an arbitrary command. For example, a value containing command separators or command substitution syntax could be interpreted by the shell when the constructed string is passed to `exec`. The prompt file expansion is enclosed in double quotes, which limits injection directly through the contents of `PROMPT.md`. However, the configuration placeholders outside that quoted expansion remain unsafe when substituted without validation. The documented availability of `- ...[truncated 2005 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The documented exec-tool command directly instructs an agent to run 'git reset --hard HEAD~N', a destructive shell operation whose scope depends on the substituted N and current repository state. Because this skill is specifically designed to drive agent tool execution, the command materially increases the chance of unintended or user-manipulated destructive repository modification.

Content

Scanner excerpt · README.md (reported line 441)May include surrounding context.

Help user rollback:

text

exec tool:
  command: "git reset --hard HEAD~N"

License

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Including 'git reset --hard HEAD~N' as a rollback escape hatch is dangerous because it irreversibly discards local changes and can be abused or misapplied by an autonomous agent operating on the wrong repository state. In a skill that already encourages background execution and autonomous iteration, a destructive reset materially increases the risk of accidental data loss and repository corruption.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md

### Escape Hatches
- Stop: `Ctrl+C`
- Kill session: process tool with action: "kill"
- Rollback: `git reset --hard HEAD~N`

### Best Practices
1. **Start small**: Test with 1-2 iterations first

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says users can ask the agent to "create a Ralph Loop" to invoke the skill, but it does not define narrower trigger conditions, exclusions, or negative examples. In a markdown skill description, this kind of open-ended activation wording can overlap with ordinary requests and make it unclear when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill recommends rollback commands like 'git reset --hard HEAD~N' in an 'Escape Hatches' section without an explicit warning that this irreversibly discards uncommitted changes and rewrites local history. In a tool-orchestrating agent context, users may follow or approve this destructive action without understanding the data-loss risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says 'Users request loops, agents execute using tools' without defining specific trigger phrases, scope limits, or exclusion conditions. 'request loops' is broad enough to overlap with ordinary discussion of loops or coding help, which can cause unintended invocation in a markdown skill description.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The phrase 'When I receive a Ralph Loop request' assumes the agent can reliably distinguish such requests, but the document does not define the required wording or boundaries. Without explicit trigger criteria or negative examples, activation remains underspecified for a markdown skill.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The skill explicitly supports auto-approval and permission-bypass flags such as '--full-auto', '--yolo', and '--dangerously-skip-permissions' for autonomous coding agents. In this context, those agents are launched via exec/process tooling and may modify code, run commands, and access the working directory without human review, substantially increasing the chance of destructive actions, secret exposure, or unsafe changes.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

## Safety & Safeguards

### Auto-Approval Flags (Risky!)
- Codex: `--full-auto` (sandboxed, auto-approve) or `--yolo` (no sandbox!)
- Claude: `--dangerously-skip-permissions`
- **Recommendation**: Use sandboxes (docker/e2b/fly) and limited credentials

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest declares "primary": "en-US" and only lists "en-US" as supported, which is a natural-language locale restriction. There is no indication here that users can opt into other languages or that the limitation is justified by a region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.