ralph

SUSPICIOUS. The skill's capabilities mostly match its stated purpose as an autonomous coding workflow, and data flows stay within local repo/GitHub/Docker contexts. The main concerns are transitive third-party skill installation via `npx skills@latest add` and high-autonomy AFK execution that can make repo and GitHub changes with authenticated tooling; these are proportionate but elevate security risk beyond benign.

No explicit malware payload is visible in the provided Bash script. However, it retrieves real OAuth and GitHub tokens from the host and injects them into a Docker sandbox, then runs an autonomous LLM/workflow with --permission-mode bypassPermissions. This creates a high-impact risk of credential leakage or unauthorized actions if the sandbox workflow or prompt-driven agent behaves unexpectedly or is compromised. Additional assessment of @ralph/prompt.md, @ralph/review-prompt.md, and the docker sandbox tool behavior is needed to confirm whether any exfiltration/malicious actions occur.