ralph-prd-starter
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill manages project state locally and follows secure practices for file operations.
- [COMMAND_EXECUTION]: The skill executes a local Python script (
python cli.py) during Phase 10 to generate project files. This is the intended core functionality for project initialization. - [PROMPT_INJECTION]: The skill ingests user-provided project descriptions and feature lists which are processed by subagents. This represents a potential indirect prompt injection surface inherent to the tool's primary purpose.
- Ingestion points: Phases 2, 3, and 8 in
PHASES.mdingest natural language input. - Boundary markers: None explicitly defined in the prompts.
- Capability inventory: The skill uses
Bash Commandfor local generation and various file system tools for state management. - Sanitization: Input is validated for basic structure, but content-level sanitization is not specified.
Audit Metadata