Security audit

Coding Sessions

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly for running persistent coding agents, but its shell templates and full-command memory logging create review-worthy risks before installation.

Install only if you are comfortable with a skill that launches background coding agents able to change files and git state. Use isolated branches or disposable worktrees, avoid copying untrusted text into the provided shell templates, sanitize session names and paths, monitor tmux output, stop sessions when done, and review all diffs and commits before trusting the result.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Shell Command Injection Through Unescaped Template Parameters
Content: View full analysis
"cd && \ PATH=/opt/homebrew/bin:\$PATH codex exec --full-auto ''; \ EXIT_CODE=\$?; echo 'EXITED:' \$EXIT_CODE; \ openclaw system event --text ' finished (exit \$EXIT_CODE) in ' --mode now; \ sleep 999999" ``` ```bash tmux -S ~/.tmux/sock new -d -s "cd && \ PATH=/opt/homebrew/bin:\$PATH ralphy --codex --prd PRD.md; \ EXIT_CODE=\$?; echo 'EXITED:' \$EXIT_CODE; \ openclaw system event --text 'Ralph loop finished (exit \$EXIT_CODE) in ' --mode now; \ sleep 999999" ``` ```bash tmux -S ~/.tmux/sock new -d -s "cd && \ PATH=/opt/homebrew/bin:\$PATH ralphy --codex --parallel --prd PRD.md; \ EXIT_CODE=\$?; echo 'EXITED:' \$EXIT_CODE; \ openclaw system event --text 'Ralph parallel finished (exit \$EXIT_CODE)' --mode now; \ sleep 999999" ``` ### Technical Analysis The documented templates insert ``, ``, and `` into a shell command containing multiple nested quoting contexts. No validation or context-aware escaping is prescribed. In the Codex template, the task description appears inside single quotes within a larger double-quoted argument passed to `tmux`. A single quote in the supplied task can terminate the intended Codex argument. Shell metacharacters can then introduce another command. Project directories and session names can similarly affect parsing when they contain whitespace, quotes, command substitutions, separators, or option-like content. Because the shell evaluates this constructed command, escaping must account for every parsing layer. Merely surrounding placeholders with quotes is insufficient. The use of `c ...[truncated 1926 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:110
Finding: Persistent Storage of Attacker-Controlled Command Content in Agent Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly recommends launching autonomous coding agents in persistent tmux sessions, including codex exec --full-auto and Ralph loops that can modify files and git state over extended periods. Without a clear warning in the skill description that these commands may write code, persist changes, and continue running unattended, users may invoke the skill without understanding the operational and security risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill promotes long-lived tmux sessions and explicitly notes that Ralph restarts with fresh context while continuing work from files and git history, which creates durable autonomous execution across iterations. In this context, persistence is the core feature, but it also increases the blast radius of bad prompts, unsafe agent behavior, or unnoticed repository modifications because the agent can continue operating after the initiating interaction ends.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
markdown
## Tasks - [ ] Create the API endpoint - [ ] Add input validation - [ ] Write tests - [x] Already done (skipped by Ralph)