ralph-loop-yylo
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingest user-assigned requests via the
$ARGUMENTSvariable inSKILL.md, establishing a surface for indirect prompt injection from untrusted task data.\n - Ingestion points: External data enters the agent context through the
$ARGUMENTSplaceholder in the main skill definition.\n - Boundary markers: The instructions explicitly direct the agent to "Stay within the assigned task," "Preserve task references and directives literally," and verify the worktree state via
yy task startbefore editing files, which serves to restrict the impact of potentially malicious input.\n - Capability inventory: The skill possesses the ability to execute shell commands (specifically
yyandgitbinaries) and perform file system writes within a scoped product worktree.\n - Sanitization: No explicit automated sanitization of
$ARGUMENTSis present; the skill relies on the agent's strict adherence to the worker contract and the local CLI's validation logic to maintain security boundaries.
Audit Metadata