ralph-github-start-loop
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script loop-github-issues.sh makes extensive use of system commands, specifically git and gh (GitHub CLI). These are used to manage repositories, create worktrees, and interact with the GitHub API for issues and pull requests.
- [DYNAMIC_EXECUTION]: The skill uses the claude CLI with the --dangerously-skip-permissions flag to run an autonomous agent. This flag explicitly bypasses security confirmation prompts, allowing the agent to execute any shell command generated during its task. Since the agent's tasks are derived from external data, this presents a significant execution risk.
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the following mechanisms: Ingestion points: The script fetches the content of PRD issues and story sub-issues directly from GitHub. This content is interpolated into the agent's prompt. Boundary markers: The prompt uses standard Markdown headers and separators to distinguish instructions from the ingested issue content. Capability inventory: The system can write to the file system (including creating worktrees outside the repository root), commit and push code, and perform network operations via the GitHub API. Sanitization: There is no evidence of sanitization or filtering of the text retrieved from GitHub issues before it is passed to the AI agent.
- [REMOTE_CODE_EXECUTION]: The combined behavior of fetching instructions from a remote source (GitHub Issues) and executing the resulting agent-generated code without user approval constitutes a remote code execution vector. If a collaborator or an attacker with issue-editing permissions provides malicious instructions, they could be executed on the local machine.
Audit Metadata