Monitored Ralph Loop

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:15 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed autonomous coding loop, but it uses powerful defaults and notification behavior that deserve careful review before use.

Install only if you intend to run an autonomous coding loop in a dedicated repository or sandbox. Before use, override unsafe defaults such as Claude permission skipping, treat RALPH_TEST as arbitrary shell code, avoid secrets in prompts or logs, review .ralph notification contents before allowing OpenClaw delivery, and do not use the systemd or sudo setup snippets unless you explicitly want host-level persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill metadata says it generates copy-paste bash scripts, but the content also instructs users to run autonomous agent CLIs, modify project files, execute tests, and invoke external notification tooling. That mismatch is security-relevant because users may grant trust or permissions based on the declared purpose while the actual workflow performs materially more powerful actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script does more than generate loop scripts: it writes detailed notification payloads containing project paths, messages, iteration metadata, and base64-encoded log tails, and then attempts to forward them to an external orchestrator via OpenClaw. This expands the trust boundary and can leak sensitive repository context or agent output to another local/external system without explicit user consent or minimization.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script directly executes AI CLIs and optional test commands instead of only producing copy-paste scripts, meaning running it causes real side effects in the repository and on the host. In the context of an agent loop skill, this materially increases risk because prompts and agent behavior can lead to file modifications, command execution, or repeated automated actions across iterations.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: When CLI is set to claude, the default flags include --dangerously-skip-permissions, which disables an important safety control without requiring explicit opt-in. In an iterative automation loop, this can allow broad file/system actions by the agent repeatedly and silently, magnifying the blast radius of prompt mistakes or malicious instructions in repository content.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The parallel execution example launches multiple background autonomous coding sessions that can modify separate worktrees concurrently, but the example itself lacks an adjacent warning about coordination, review, merge conflicts, and resource contention. This increases the chance of unsafe or hard-to-audit code changes being produced simultaneously without clear operator oversight.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script executes RALPH_TEST via bash -lc, so any content placed in that environment variable is executed as shell code. While this may be intentional configurability, it creates a straightforward command-injection and unsafe-execution path, especially in CI, shared shell environments, or when users copy untrusted examples.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The dangerous Claude permission-skipping flag is enabled in code but not clearly disclosed in help text or warnings, so users may invoke the script without realizing safety barriers are being bypassed. Hidden unsafe defaults are particularly risky in agent automation because they reduce informed consent and increase the chance of unintended destructive actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The notification payload includes project directory, project name, free-form messages, details, CLI choice, iteration data, and a base64-encoded tail of the log, then may forward an event to OpenClaw. Without an explicit privacy/security warning, users may unknowingly expose sensitive code, file paths, secrets in logs, or internal project metadata to another component.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template instructs the agent to commit changes and mark tasks complete in repository files without requiring explicit user consent or a prior warning that the workflow will mutate the repository history and working tree. In an agent setting, this can lead to unintended persistent changes, misleading task completion state, and unauthorized commits that are difficult to review or unwind.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template directs the agent to write notification data to a local file and explicitly notes that the wrapper script may attempt immediate external delivery via `openclaw gateway call cron.add`, but it gives no user-facing disclosure, consent mechanism, or restriction on notification contents. This creates a risk of unreviewed local persistence and possible exfiltration of project details, errors, or sensitive operational context to an external system.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety

⚠️ Auto-approve flags (`--full-auto`, `--dangerously-skip-permissions`) give the agent write access.

- Run in a dedicated branch
- Use a sandbox for untrusted code

• Confidence: 95% confidence
• Finding: Auto-approve

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Requires git repository
- **Each `codex exec` is a fresh session** — no memory between calls
- `--full-auto`: Auto-approve in workspace (sandboxed)
- `--yolo`: No sandbox, no approvals (dangerous but fast)
- Default model: gpt-5.2-codex

### Claude Code

• Confidence: 88% confidence
• Finding: no approval

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Codex
- Requires git repository
- **Each `codex exec` is a fresh session** — no memory between calls
- `--full-auto`: Auto-approve in workspace (sandboxed)
- `--yolo`: No sandbox, no approvals (dangerous but fast)
- Default model: gpt-5.2-codex

• Confidence: 83% confidence
• Finding: Auto-approve

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Default model: gpt-5.2-codex

### Claude Code
- `--dangerously-skip-permissions`: Auto-approve (use in sandbox)
- No git requirement
- Each invocation is fresh

• Confidence: 84% confidence
• Finding: Auto-approve

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.