Security audit

Coding Agent Loops

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it asks users to run persistent autonomous coding-agent loops through shell templates and an unpinned global npm tool, which deserves careful review before installation.

Install only if you are comfortable running long-lived autonomous coding agents in your repositories. Pin and verify ralphy-cli before installing it, avoid global installation where possible, do not paste untrusted issue text or paths into the shell templates, and actively list and kill tmux sessions when work is done.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Global Installation of a Third-Party Dependency
Content: View full analysis
Remediation: View remediation
``` 2. Document the package's expected publisher, official source repository, and npm registry. 3. Verify package provenance and integrity before installation, including the published tarball and lifecycle scripts. 4. Prefer a project-local dependency managed by a committed lockfile instead of a global installation. 5. Use `npm ci` with a reviewed lockfile where practical. 6. Run the dependency with least privilege in an isolated account, container, or sandbox, particularly because it orchestrates autonomous coding agents. 7. Establish a controlled update and re-audit process rather than automatically consuming the latest release. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:21
Finding: Shell Command Injection Risk from Unsafe Command-Template Substitution
Content: View full analysis
finished (exit $EXIT_CODE) in $(pwd)" --mode now; \ sleep 999999 ``` ### Technical Analysis The Skill encourages users or automation to replace repository paths, task descriptions, PRD paths, and session names inside commands that are parsed by a shell and then passed as a quoted command string to tmux. It does not provide validation or shell-safe argument-passing requirements. This creates multiple parsing boundaries. Shell metacharacters embedded in a substituted value can terminate quoting or introduce additional commands. For example, a task description containing a single quote followed by a semicolon could escape the single-quoted argument inside the tmux command string. An unquoted repository path can similarly use spaces, semicolons, command substitutions, or other control characters to alter execution. The examples are static documentation and do not themselves process untrusted inp ...[truncated 1809 chars]
Remediation: View remediation
&2 exit 2 } repo=$(cd -- "$repo" && pwd -P) tmux -S "$HOME/.tmux/sock" new-session -d -s "$session" \ env REPO="$repo" TASK="$task" SESSION="$session" \ bash -c ' cd -- "$REPO" || exit ralphy --codex "$TASK" exit_code=$? printf "EXITED: %s\n" "$exit_code" openclaw system event \ --text "Ralph loop $SESSION finished (exit $exit_code) in $PWD" \ --mode now sleep 999999 ' ``` 9. Review any automation built from the original templates to determine whether untrusted values are currently interpolated without validation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.