The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script afk-ralph.sh programmatically extracts sensitive authentication tokens from the host environment to facilitate autonomous operation. It specifically harvests Claude Code OAuth credentials from the macOS Keychain using security find-generic-password -s "Claude Code-credentials" -w and GitHub authentication tokens via the gh auth token command. These secrets are then injected into the Docker sandbox filesystem (/home/agent/.claude/.credentials.json and /etc/sandbox-persistent.sh), exposing them to the AI agent.
[INDIRECT_PROMPT_INJECTION]: The skill features a large attack surface for indirect prompt injection as it processes external, untrusted data within a privileged execution context.
Ingestion points: The scripts afk-ralph.sh and ralph-once.sh use gh issue view to retrieve PRD issue descriptions and sub-issue content directly from GitHub.
Boundary markers: No protective boundary markers or instructions to ignore embedded commands are present. The fetched content is concatenated directly into the instructions provided to the agent.
Capability inventory: The agent is granted significant permissions, including arbitrary shell command execution within a Docker container (with bypassPermissions enabled), access to the GitHub API via the harvested token, and the ability to modify the project's source code and commit history.
Sanitization: No sanitization or validation is performed on the issue content before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: SKILL.md instructs users to install and run additional software from an external GitHub repository (mattpocock/skills) via npx. This establishes a dependency on third-party code that is executed with the user's privileges during setup.
[COMMAND_EXECUTION]: The skill requires the user to grant execution permissions to multiple shell scripts (chmod +x). These scripts subsequently execute host-level commands for credential extraction, Docker container management, and Git operations, while the agent itself is instructed to dynamically determine and run project-specific test suites.

ralph