The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates an indirect injection vulnerability by reading external project files into the agent's instruction set during its recursive loop.
Ingestion points: The shell script ralph-loop.sh reads prd.json and progress.txt from the local directory.
Boundary markers: The ingested content is wrapped in markdown code blocks (triple backticks) within the prompt template, which provides insufficient isolation to prevent malicious instructions inside those files from overriding the agent's behavior.
Capability inventory: The agent has full access to the environment's tools, including filesystem modification, shell command execution, and network access.
Sanitization: The script performs no validation, escaping, or filtering of the file contents before they are interpolated into the system prompt.
[COMMAND_EXECUTION]: The skill implements an autonomous development loop using a bash script that invokes the claude CLI with the --yes (auto-confirm) flag. This configuration enables high-autonomy operations where the agent can execute code and modify the system across multiple iterations without human review or confirmation.
[DYNAMIC_EXECUTION]: The skill generates and executes local scripts as a core feature. It populates a shell script (ralph-loop.sh) from a template, instructs the agent to make it executable via chmod +x, and then relies on this generated script to orchestrate and execute the agent's autonomous activities.

ralph