ralph-loop
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific files to determine its next steps and validation logic, which allows external content to influence agent behavior.
- Ingestion points: The agent reads requirement specifications from the 'specs/' directory, task lists from 'IMPLEMENTATION_PLAN.md', and operational commands from 'AGENTS.md'.
- Boundary markers: No delimiters or safety instructions are used to separate untrusted data in these files from the agent's core instructions.
- Capability inventory: The skill has the capability to modify the filesystem, perform git operations, and execute shell commands.
- Sanitization: There is no mechanism to validate or sanitize the tasks or commands extracted from the workspace files before they are acted upon.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to execute shell commands sourced from the project environment. In the 'Building Mode' section of SKILL.md, the agent is told to run tests, typechecks, and linters as specified in 'AGENTS.md' or standard scripts like 'npm test'. This delegates command control to the workspace context, which could be malicious if the repository is untrusted.
Audit Metadata