ralph
Warn
Audited by Socket on Apr 10, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS: the visible skill is a thin loader for an unreviewed local workflow, and its stated purpose includes a persistent self-referential loop. There is no direct evidence of malware, credential theft, or remote installer abuse in the supplied file, but the hidden delegated instructions create medium risk and prevent full verification.
Confidence: 82%Severity: 58%
Audit Metadata