Writes ralph loops for you that you can copy and paste

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:21 AM UTC
• Version: 1.0.0

Overview

This skill is a command generator, but it steers users toward unattended AI CLI loops that bypass approval prompts and may run without strong limits.

Review generated commands carefully before running them. Avoid approval-bypass flags unless you are in a disposable or tightly scoped workspace, prefer finite iteration and time limits, keep files under version control, and do not run the commands with elevated privileges or sensitive credentials available.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:154

Finding

Generated Agent Commands Disable Permission Safeguards by Default

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:208

Finding

Infinite Autonomous Execution Without Mandatory Resource or Failure Limits

Content

View full analysis

nul) ``` ```bash i=1; while :; do echo -e "\n=== Run $i ==="; start=$(date +%s); cat PROMPT.md | [AI_COMMAND]; dur=$(($(date +%s) - start)); echo "⏱️ Time: ${dur}s"; echo "⏸️ Waiting X seconds..."; sleep X; ((i++)); done ``` ### Technical Analysis The PowerShell, CMD, and Bash templates contain deliberately infinite loops. They do not enforce a maximum number of iterations, elapsed-time ceiling, retry limit, cost ceiling, or stop-on-error condition. A delay reduces request frequency but does not provide a termination guarantee. Manual interruption with Ctrl+C is not an adequate safeguard for unattended execution, terminal disconnection, background operation, or cases where the user does not notice harmful behavior promptly. The risk is compounded by the permission-bypass behavior in other command templates. A malicious or erroneous prompt can consequently trigger the same operation indefinitely. ### Attack Path 1. The user selects the “Infinite with delay” loop type. 2. The Skill generates one of the unbounded shell loops. 3. The user executes the generated command. 4. The loop repeatedly submits `PROMPT.md` to the selected AI CLI. 5. The prompt causes an expensive, destructive, or otherwise unintended operation. 6. Because there is no mandatory iteration, duration, failure, or cost limit, the ope ...[truncated 724 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

Custom Parameters Are Inserted Into Shell Templates Without Required Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill repeatedly recommends commands with dangerous auto-approval or permission-bypass flags such as --dangerously-skip-permissions, --yolo, and an auto-approving grok-auto flow, without placing a prominent safety warning before users are steered toward them. In the context of automation loops that repeatedly feed PROMPT.md to an agent, this can lead to unchecked file modification, command execution, or repeated harmful actions if the prompt or model behavior is unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly instructs the user to create a PROMPT.md that causes an AI to read and then update STATUS.md, and it also states the tool saves generated commands to a timestamped markdown file. Even though this is documentation rather than executable code, it normalizes automated modification of user workspace files without warning, confirmation, backup guidance, or scope limits, which can lead to unintended overwrites or unsafe automation in real use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file first states that Claude Code should use piped input with claude-code and explicitly says piping should be used instead of claude -p (L151-L162). A few lines later it says the placeholder must be replaced with claude -p (Get-Content PROMPT.md -Raw) and marks that as CRITICAL because Claude requires the prompt as a command-line argument (L182-L195). These instructions actively conflict about whether Claude input is piped to claude-code or passed as an argument to claude -p.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The skill promotes autonomous execution by using --yolo and describing grok-auto as auto-approving permissions inside looping automation. Because the purpose of the skill is to generate ready-to-run repeated agent commands, the autonomous behavior is amplified: a single unsafe prompt can be executed many times without human review, increasing the chance and scale of destructive actions.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

- gemini-2.5-pro: `Get-Content PROMPT.md -Raw | gemini --model gemini-2.5-pro --yolo`

**For Grok CLI (PowerShell):**
- Default: `Get-Content PROMPT.md -Raw | grok-auto` (uses default model from GROK_MODEL env var, auto-approves permissions)
- grok-code-fast-1: `Get-Content PROMPT.md -Raw | grok-auto -m grok-code-fast-1`
- grok-4-latest: `Get-Content PROMPT.md -Raw | grok-auto -m grok-4-latest`
- grok-beta: `Get-Content PROMPT.md -Raw | grok-auto -m grok-beta`

Static analysis

No suspicious patterns detected.