Ralph Loop (Agent Mode)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:32 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed automation guide, but it gives agents broad command-execution patterns that can run coding tools with reduced safeguards and includes risky rollback guidance.

Install only if you want an agent to run and monitor other coding agents in your project. Use a sandbox or isolated worktree, avoid --yolo and --dangerously-skip-permissions, validate any CLI/model/flag values before execution, and do not approve git reset --hard unless you have backed up or reviewed the repository state.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:58
• Finding: Shell Command Injection Through Unvalidated CLI Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–65; related command construction guidance at lines 169–180 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```text 1. **Use exec tool** to launch the coding agent: ``` exec tool with parameters: - command: "opencode run --model <MODEL> \"$(cat PROMPT.md)\"" - workdir: <project_path> - background: true - pty: true - yieldMs: 60000 - timeout: 3600 ``` The related command templates and optional flags include: ```text | **OpenCode** | `opencode run --model <MODEL> "$(cat PROMPT.md)"` | | **Codex** | `codex exec <FLAGS> "$(cat PROMPT.md)"` (requires git) | | **Claude Code** | `claude <FLAGS> "$(cat PROMPT.md)"` | | **Pi** | `pi --provider <PROVIDER> --model <MODEL> -p "$(cat PROMPT.md)"` | | **Goose** | `goose run "$(cat PROMPT.md)"` | Common flags: - Codex: `--full-auto`, `--yolo`, `--model <model>` - Claude: `--dangerously-skip-permissions` ``` ### Technical Analysis The Skill instructs an agent to collect CLI, model, provider, flag, and working-directory values and interpolate them into a shell command string. It does not require strict allowlisting, shell-safe argument handling, structured executable/argument arrays, or rejection of shell metacharacters. If an attacker can influence a value substituted for `<MODEL>`, `<FLAGS>`, `<PROVIDER>`, or a custom CLI command, shell syntax embedded in that value may terminate or alter the intended command and append an arbitrary command. For example, a value containing command separators or command substitution syntax could be interpreted by the shell when the constructed string is passed to `exec`. The prompt file expansion is enclosed in double quotes, which limits injection directly through the contents of `PROMPT.md`. However, the configuration placeholders outside that quoted expansion remain unsafe when substituted without validation. The documented availability of `- ...[truncated 2005 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Avoid shell command strings** - Invoke tools using a structured executable and argument array. - Pass the prompt as a discrete argument or through standard input rather than using `$(cat PROMPT.md)`. 2. **Strictly allowlist configuration** - Permit only explicitly supported CLI executable names. - Validate model and provider names against known-safe identifiers. - Represent optional flags as enumerated configuration choices rather than arbitrary text. - Reject values containing shell metacharacters, whitespace patterns, redirection operators, command substitutions, or control characters. 3. **Do not accept arbitrary CLI fragments** - Separate the executable, model, provider, and flags into distinct validated fields. - Resolve executables to trusted absolute paths where feasible. - Do not permit users or repository content to supply raw command prefixes or suffixes. 4. **Harden auto-approval behavior** - Disable `--yolo` and `--dangerously-skip-permissions` by default. - Require explicit, informed user confirmation before enabling any auto-approval mode. - Prefer the most restrictive sandbox and permission mode supported by the selected CLI. 5. **Enforce execution isolation** - Run coding agents in a container or equivalent sandbox with a read/write mount limited to the intended repository. - Remove unrelated credentials and sensitive environment variables. - Apply outbound network restrictions unless network access is required. - Run under a dedicated, unprivileged operating-system account. 6. **Validate paths** - Resolve and verify the working directory against an approved project root. - Reject traversal, symlink escapes, and paths outside the authorized workspace. 7. **Update all examples** - Replace unsafe command-string examples in both `SKILL.md` and `README.md`. - Document that configuration originating from users, repositories, prompts, or generated f ...[truncated 40 chars]

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Help user rollback:**
```
exec tool:
  command: "git reset --hard HEAD~N"
```

## License

• Confidence: 95% confidence
• Finding: The documented exec-tool command directly instructs an agent to run 'git reset --hard HEAD~N', a destructive shell operation whose scope depends on the substituted N and current repository state. Because this skill is specifically designed to drive agent tool execution, the command materially increases the chance of unintended or user-manipulated destructive repository modification.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Escape Hatches
- Stop: `Ctrl+C`
- Kill session: process tool with action: "kill"
- Rollback: `git reset --hard HEAD~N`

### Best Practices
1. **Start small**: Test with 1-2 iterations first

• Confidence: 91% confidence
• Finding: Including 'git reset --hard HEAD~N' as a rollback escape hatch is dangerous because it irreversibly discards local changes and can be abused or misapplied by an autonomous agent operating on the wrong repository state. In a skill that already encourages background execution and autonomous iteration, a destructive reset materially increases the risk of accidental data loss and repository corruption.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README says users can ask the agent to "create a Ralph Loop" to invoke the skill, but it does not define narrower trigger conditions, exclusions, or negative examples. In a markdown skill description, this kind of open-ended activation wording can overlap with ordinary requests and make it unclear when the skill should activate versus when it should not.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill recommends rollback commands like 'git reset --hard HEAD~N' in an 'Escape Hatches' section without an explicit warning that this irreversibly discards uncommitted changes and rewrites local history. In a tool-orchestrating agent context, users may follow or approve this destructive action without understanding the data-loss risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says 'Users request loops, agents execute using tools' without defining specific trigger phrases, scope limits, or exclusion conditions. 'request loops' is broad enough to overlap with ordinary discussion of loops or coding help, which can cause unintended invocation in a markdown skill description.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The phrase 'When I receive a Ralph Loop request' assumes the agent can reliably distinguish such requests, but the document does not define the required wording or boundaries. Without explicit trigger criteria or negative examples, activation remains underspecified for a markdown skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety & Safeguards

### Auto-Approval Flags (Risky!)
- Codex: `--full-auto` (sandboxed, auto-approve) or `--yolo` (no sandbox!)
- Claude: `--dangerously-skip-permissions`
- **Recommendation**: Use sandboxes (docker/e2b/fly) and limited credentials

• Confidence: 94% confidence
• Finding: The skill explicitly supports auto-approval and permission-bypass flags such as '--full-auto', '--yolo', and '--dangerously-skip-permissions' for autonomous coding agents. In this context, those agents are launched via exec/process tooling and may modify code, run commands, and access the working directory without human review, substantially increasing the chance of destructive actions, secret exposure, or unsafe changes.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The manifest declares "primary": "en-US" and only lists "en-US" as supported, which is a natural-language locale restriction. There is no indication here that users can opt into other languages or that the limitation is justified by a region-specific purpose.

Static analysis

No suspicious patterns detected.