Ralph Loop
Security checks across malware telemetry and agentic risk
Overview
The skill is broadly coherent with an autonomous coding loop (Ralph) but has several operational and privacy mismatches you should understand before running it (it will invoke a local LLM CLI, may send your project code to an external service, and copies files from an assumed local path).
This skill implements an autonomous coding loop (Ralph) that relies on your local Ralph scripts and an external LLM CLI (Codex or Claude). Before installing or running it: 1) Inspect the ~/Code/ralph/ files (ralph.sh, prompt.md, CLAUDE.md) that the script will copy into your project — they determine what is sent to the LLM. 2) Understand that run-ralph.sh pipes project prompts (and likely code/state) to 'codex exec' which transmits data to an external service; do not run it on repositories containing secrets or proprietary code unless you accept that. 3) The script uses '--dangerously-skip-permissions' for Codex CLI — this bypasses safety checks and can allow broader actions by the CLI; avoid or remove that flag if you want stricter controls. 4) The skill does not declare required credentials but you will need configured CLI auth for Codex/Claude — confirm how your CLI stores/uses keys. 5) If you want to proceed, run the scripts in a sandbox or on a non-sensitive repo first, review the contents of prompt templates and ralph.sh, and back up your repository (or run on a branch). If anything is unclear, ask the skill author for explicit documentation on what is sent to external services and what the expected local layout is.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings