ralph-review-deep

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill intentionally aggregates repository contents into a prompt sent to external LLM services and instructs those remote models to perform tool calls (bash) that will execute on the host — enabling data exfiltration and remote code execution risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 4, the required workflow concatenates outsider-authored .llmtmp/* files plus bd list/bd ready outputs and per-task bead descriptions from the repo’s bd graph into CONTEXT, which is then fed as the prompt to the opencode reviewer LLMs in Step 5/Step 7.