Ralph Security Audit

• Outcome: Pass
• Latest audit: May 27, 2026, 10:02 PM
• Version:
  3.0.0

Overview

This appears to be a legitimate security-audit skill whose sensitive repository inspection and report-writing behavior matches its stated purpose.

Install this only if you want an agent to inspect the current project for security issues, including possible secrets and environment-related configuration. Expect it to write or rename local Ralph report files, and review generated findings before sharing them because audit reports may contain sensitive paths, variable names, or secret indicators.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough to match routine user requests like 'security audit' or 'check for vulnerabilities,' which can cause this skill to activate unexpectedly. Because the skill performs long-running analysis and writes report files into the workspace, over-broad activation increases the chance of unintended file modification and unnecessary repository inspection.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly renames existing `.ralph-report.md` files and auto-saves progress, but the user-facing description does not warn that files in the workspace will be modified. This can lead to surprising file changes, overwriting or cluttering reports, and unsafe use in sensitive repositories where even benign writes are undesirable.

VirusTotal

66/66 vendors flagged this skill as clean.