setup-ralph-loop
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes shell scripts (
ralph-once.sh,ralph.sh) that leverage thegh(GitHub) andclaudeCLI tools to automate issue processing and agent execution within the repository. - [DYNAMIC_EXECUTION]: The skill dynamically generates shell scripts based on repository configuration, feedback loops detected via
sidecar.sh profile, and current GitHub issue states. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill reads data from external sources such as GitHub issues (via
gh issue list), repository metadata (package.json), and sidecar configuration (sidecar.json) inSKILL.md. - Boundary markers: The generated prompts for the sub-agent interpolate variables like
$FRONTIER(listing unblocked issues) and$PROFILE(repository facts) without explicit XML-style delimiters or specific instructions to ignore embedded commands within issue text. - Capability inventory: The skill possesses capabilities for shell command execution (
gh,claude) and local file system writes across its generated scripts. - Sanitization: There is no evidence of sanitization or escaping applied to the ingested GitHub issue content before it is interpolated into the Ralph agent's prompt.
Audit Metadata