Ralph Loop (Agent Mode)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:45 AM UTC
• Version: 1.1.0

Overview

This skill is transparent about orchestrating coding agents, but it gives them broad command, file, background-process, auto-approval, commit, and hard-reset abilities with incomplete guardrails.

Install only if you intentionally want an agent to run other coding agents inside a trusted project. Use a disposable branch or sandbox, keep the working directory narrow, avoid --yolo and permission-skipping flags, and require explicit approval before commits, hard resets, rollback commands, or use of project credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (6)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The invocation guidance is broad enough that an agent may activate this skill from a generic request like 'create a Ralph Loop' without strong boundary checks on repository trust, task scope, or execution safety. In this skill’s context, activation leads directly to launching interactive coding CLIs via exec/process, so ambiguous triggering increases the chance of unintended autonomous command execution in sensitive environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README presents rollback actions including 'git reset --hard HEAD~N' as an escape hatch without an immediate, explicit warning that this permanently discards uncommitted changes and rewrites history. Because this skill is specifically designed to drive autonomous coding agents that can execute shell commands, documenting destructive rollback commands in an operational playbook materially raises the risk of accidental data loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The manifest requests powerful capabilities (exec, process, and file-write) that allow arbitrary command execution, process control, and filesystem modification, but the package description does not clearly warn users about those risks. In a skill specifically designed to orchestrate external coding agents and generate bash-driven automation loops, this missing disclosure materially increases the chance that users grant dangerous permissions without understanding the trust boundary.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety & Safeguards

### Auto-Approval Flags (Risky!)
- Codex: `--full-auto` (sandboxed, auto-approve) or `--yolo` (no sandbox!)
- Claude: `--dangerously-skip-permissions`
- **Recommendation**: Use sandboxes (docker/e2b/fly) and limited credentials

• Confidence: 95% confidence
• Finding: auto-approve

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Escape Hatches
- Stop: `Ctrl+C`
- Kill session: process tool with action: "kill"
- Rollback: `git reset --hard HEAD~N`

### Best Practices
1. **Start small**: Test with 1-2 iterations first

• Confidence: 91% confidence
• Finding: git reset --hard

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

### Escape Hatches
- Stop: `Ctrl+C`
- Kill session: process tool with action: "kill"
- Rollback: `git reset --hard HEAD~N`

### Best Practices
1. **Start small**: Test with 1-2 iterations first

• Confidence: 90% confidence
• Finding: git reset --hard; Non-interactive

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.