ralphmode

SUSPICIOUS: the skill is internally coherent as a permission-tuning guide, but its core function is to weaken approval barriers and expose documented high-autonomy modes. There is no clear credential theft, exfiltration, or malicious installer behavior; the main risk is enabling unsafe agent execution if users apply the bypass-oriented presets outside the intended sandbox boundary.

The file is documentation and configuration guidance, not malware. It contains no evident credential theft, exfiltration, destructive execution, or persistence. The principal security concern is that it documents and normalizes unrestricted execution modes and relies on bypassable regex or prompt-based safeguards. Use only in disposable, isolated environments and prefer allow-listed execution with sensitive paths excluded.