Ralph Loops

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:18 AM UTC
• Version: 1.0.2

Overview

This skill is a coherent autonomous coding loop, but it gives the agent broad ungated authority to edit, run commands, commit, and push code remotely.

Install only in an isolated repository or VM with minimal credentials. Review the templates before running, remove or disable automatic git push/tag behavior unless you explicitly want remote publication, and do not expose the dashboard to a network without authentication.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: This is a real bug with security-relevant availability impact: `pricing` is declared as a `const` and then reassigned in the unknown-model fallback path, which will throw at runtime instead of applying the intended default. If model identifiers can come from external or untrusted input, an attacker or malformed request could trigger predictable failures in cost calculation, leading to broken billing, dashboard errors, or denial of service for affected flows.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file includes a session-termination primitive that can abort external sessions via a shell command. Even if intended for loop management, this expands the skill from passive monitoring into active state modification, and there is no visible authorization, allowlist, or contextual restriction on which session keys may be terminated.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script describes the agent as using 'minimal context' while spawning `claude` with `--dangerously-skip-permissions`, which disables an important safety control. In this loop, the agent is repeatedly instructed to modify files and can be driven by arbitrary prompt content, so suppressing permission checks materially increases the chance of destructive or unauthorized actions in the workspace.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The prompt explicitly instructs the agent to modify repository state (`git add -A`, `git commit`) and publish it remotely (`git push`) as part of normal operation, but no bounded skill purpose or approval gate is provided. In a reusable build skill, this creates an unsafe default where code changes can be committed and exfiltrated to a remote without user confirmation, increasing the risk of unintended publication, credential misuse, or propagation of malicious/incorrect changes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The prompt authorizes updating `specs/*` when inconsistencies are found, even though specifications are normally a source of truth rather than an output artifact of an implementation skill. Allowing the agent to rewrite requirements lets it silently redefine expected behavior to fit its own implementation or hide defects, undermining integrity and making downstream changes harder to audit.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script automatically performs `git push` to `origin` after every iteration, which can exfiltrate generated code or repository contents to a remote service without per-iteration user confirmation. In the context of an autonomous loop that also grants the agent broad execution authority, repeated remote pushes materially increase the blast radius of any bad model action or prompt injection.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The trigger flow encourages starting autonomous loops without an upfront warning that execution may run with `--dangerously-skip-permissions` and can modify files asynchronously. That is dangerous because users may invoke the skill expecting ordinary assistance, while the loop can launch a long-running process with broad authority before informed consent is obtained.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start section tells users to run `./loop.sh build` without first warning that the loop can autonomously modify the repository and create commits. This increases the chance of unintended code changes or execution in sensitive environments, especially because the skill promotes unattended operation and later discloses dangerous permission bypass.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The abort operation is destructive and executes immediately without any confirmation, dry-run mode, or higher-level guardrail. If exposed through UI or automation, an accidental or unauthorized call could terminate legitimate running work and disrupt active agent sessions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code enumerates and reads transcript files from a user-specific session directory under the home folder, which likely contains prior conversation content and metadata. Even though the file access is local and there is no direct exfiltration shown here, accessing private conversation history without clear user disclosure or consent is a privacy vulnerability because it enables silent collection and processing of sensitive user data.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The route exposes a destructive action that terminates running loops, yet there is no visible authentication, authorization, CSRF protection, or confirmation mechanism in this handler. In a dashboard context, an attacker who can reach this endpoint may be able to disrupt active processing or operations by killing loops, making this a meaningful integrity and availability risk.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script invokes the `claude` CLI with `--dangerously-skip-permissions` and does not provide a strong user-facing warning at the point of use. Because the loop runs autonomously, persists state, and tells the agent to continue working and write files until completion, disabling permission safeguards can enable broad unintended file or command actions if the prompt, workspace, or model behavior is unsafe.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The instructions tell the agent to run `git add`, `git commit`, `git push`, and later create tags, but they do not warn the user that repository state will be modified and potentially published to a remote. This lack of transparency is dangerous because users may invoke the skill expecting local build assistance, not automatic source-control publication with irreversible or externally visible effects.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The prompt directs automatic updates to `@IMPLEMENTATION_PLAN.md`, potentially `@AGENTS.md`, and other project files as routine behavior, but does not warn that user-managed files will be changed. In a generic build prompt, silent multi-file modification can overwrite user intent, pollute planning/docs artifacts, and normalize broad write access beyond the immediate coding task.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The prompt defines a very broad planning workflow over large portions of the repository and permits massive parallel delegation without any explicit activation guard, repository boundary checks, or task trigger constraints. In an agent-skill context, this can cause the skill to activate in unintended situations, over-collect context, and amplify the effect of any prompt injection or unsafe repository content encountered during analysis.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script combines `--dangerously-skip-permissions` with unattended execution and automatic remote pushes, but does not provide a strong, explicit warning or require informed consent for these high-risk actions. In a skill context, this is especially dangerous because prompt content can steer the model into destructive filesystem, credential, or network actions that are then auto-approved and published.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Run Ralph iteration with selected prompt
    # -p: Headless mode (non-interactive, reads from stdin)
    # --dangerously-skip-permissions: Auto-approve all tool calls
    # --model opus: Use Opus for complex reasoning
    cat "$PROMPT_FILE" | claude -p \
        --dangerously-skip-permissions \

• Confidence: 96% confidence
• Finding: Auto-approve

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: express==4.18.2

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: dashboard/lib/ralph-reader.mjs:202

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/ralph-loop.mjs:256