Ralph Ultra Security Audit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:21 PM UTC
• Version: 3.0.0

Overview

This is a coherent deep security-audit skill, but it asks for broad local and environment access and automatic report file changes without enough user control or secret-handling safeguards.

Install only if you want a very broad, long-running security audit and are comfortable with the agent reading sensitive project configuration, secrets metadata, git history, remotes, and infrastructure files. Before use, set a report path, preserve any existing .ralph-report.md, require redaction of secrets, and require explicit approval before any network, runtime, or penetration-test activity.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The skill calls for 'variable audit' and '.env drift' review, which can expose the agent to plaintext secrets such as API keys, passwords, and tokens. In a security-audit context this is somewhat expected, but without strict guidance to redact, avoid exfiltration, and minimize secret handling, the skill increases the chance of credential disclosure in outputs, logs, or report files.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

- **1-20:** Platform sync — auto-detect stack, git sync, hash verification, environment drift
- **21-50:** Attack surface — endpoint enumeration, auth mapping, rate limits, exposed ports, WebSocket/SSE
- **51-75:** Hidden systems — undeclared services, cron jobs, orphan configs, Docker networks
- **76-100:** Environment & docs — variable audit, .env drift, documentation accuracy, scoring

### Phase 2: OWASP Top 10 (101-250)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly says to update .ralph-report.md every 50 iterations, which is a local file write side effect without any warning or consent mechanism. Silent artifact creation/modification can overwrite user work, leak sensitive findings into the repo, or pollute source control in contexts where a security review should be non-destructive by default.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs the agent to run git rev-parse --show-toplevel and git remote -v, and earlier references 'git sync', which expands the skill from passive review into repository/environment interrogation. Enumerating remotes can reveal internal repository URLs or credentials embedded in remotes, and 'sync' behavior implies state-changing or network-reaching actions not necessary for a read-only audit.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The 'penetration test simulation' step introduces adversarial testing behavior beyond the declared description of a deep audit. Even if framed as simulation, this can lead an agent to generate or attempt exploit-like actions, increasing the risk of unsafe testing against live systems or encouraging behavior the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to rename an existing report on start alters prior artifacts automatically and provides no warning about changing or superseding existing files. Automatic renaming can destroy expected file references, interfere with audit trails, or mishandle prior sensitive reports without user approval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file says to "Activate the appropriate persona based on current phase" but does not define how the phase is determined, how personas are selected, or any exclusion conditions. The lack of specific trigger scope or negative examples makes invocation behavior ambiguous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The instructions direct assessment of exposed ports, WebSocket/SSE, undeclared services, Docker networks, and environment drift, which can push the agent toward probing live or runtime infrastructure rather than reviewing provided code/config only. In an agent skill, that broadens scope to potentially sensitive systems and may trigger unintended network discovery beyond what the manifest clearly discloses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.