ralph-swarm
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of natural language objectives defined in an external manifest file, creating a potential surface for indirect prompt injection.
- Ingestion points: The
sessions[].goalstrings provided in the JSON manifest used to drive individual lane operations. - Boundary markers: The instructions lack specific guidance on using delimiters or "ignore embedded instructions" warnings when interpolating these goals into downstream sessions.
- Capability inventory: The skill performs git operations (cloning, fetching, and ref management) and orchestrates execution of the
ralph-loopskill across multiple isolated directories. - Sanitization: There is no evidence of validation or sanitization of the goal strings before they are passed to the agent's context.
Audit Metadata