The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a dynamic context injection pattern in SKILL.md to execute PLUGIN_ROOT/scripts/setup-ralph-loop.sh using $ARGUMENTS. This allows unsanitized user input to flow directly into a shell execution context during the skill initialization phase, creating a command injection vulnerability.
[DATA_EXFILTRATION]: The scripts/stop-hook.sh script programmatically accesses the full session transcript file ($TRANSCRIPT_PATH) to monitor assistant messages. This constitutes access to sensitive session data, including previous user inputs and model responses, which is a significant privacy and security concern if the data were to be exfiltrated.
[PROMPT_INJECTION]: The SKILL.md file contains instructions that attempt to override the agent's standard behavior and exit protocols. It commands the agent to use a 'self-blocking exit pattern' and 'not output false promises to escape the loop,' effectively trapping the agent in an autonomous feedback loop that ignores standard termination signals.
[PROMPT_INJECTION]: The iterative loop mechanism functions by storing user-provided prompt text in a local state file and re-injecting it into the agent's context via the stop hook's reason field. This creates an indirect prompt injection surface where instructions in the original prompt are repeatedly applied to the session without standard boundary markers or sanitization.

ralph-wiggum