Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent quick security review skill that inspects a project and writes a local report, with no evidence of hidden execution, exfiltration, or persistence.
Install only if you are comfortable with the agent reading project files for a security spot-check and creating or renaming `.ralph-report.md` in the workspace. Review the generated findings manually, especially pattern-match results.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Iter | Check |
|------|-------|
| 1 | Auto-detect stack, infra, git sync |
| 2 | .env in .gitignore check |
| 3 | Hardcoded secrets scan |
| 4 | DEBUG mode detection |
| 5 | SQL injection patterns |
The trigger phrases include broad, natural language such as 'daily security check' and 'pre-deploy audit', which increases the chance of accidental invocation. Because this skill can read sensitive files and write reports, overbroad activation raises the risk of unintended scanning or workspace modification without deliberate user intent.
The instruction to run git rev-parse --show-toplevel introduces shell command execution capability into a skill described as a quick spot-check. Even though the command is relatively constrained, it expands the skill's privileges and establishes a pattern of command execution that could be unsafe in stricter environments or if later modified.
The skill directs report-file renaming and writing without warning the user that it will modify workspace files. Hidden write behavior is dangerous because it can overwrite or rename artifacts, create noise in repos, and violate user expectations for a security-review skill that appears observational.
The skill goes beyond passive analysis by instructing the agent to rename an existing report file and write a new .ralph-report.md. Workspace modification is a real side effect that is not clearly surfaced in the manifest description, which can surprise users and alter repository state during what appears to be a read-mostly security check.
No suspicious patterns detected.