ralph-wiggum

SUSPICIOUS: the skill’s purpose and local file usage are broadly coherent, but it relies on an unseen script and stop-hook mechanism while deliberately creating a persistent autonomous loop that resists normal exit. No clear credential theft or exfiltration is visible, so this is better classified as a medium-risk agent-control and opaque-execution skill rather than malware.

This fragment is a benign-seeming lifecycle hook configuration, but it creates an execution sink by running an external shell script on plugin Stop. Because the script contents and PLUGIN_ROOT validation are not shown, the main risk is indirect: what stop-hook.sh does and whether the resolved path can be manipulated.