The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches components from the author's official repositories.
Installation instructions recommend downloading the extension from the author's NPM package (@tmustier/pi-ralph-wiggum) and GitHub repository (tmustier/pi-extensions).
[DATA_EXFILTRATION]: Path traversal vulnerability in file operations.
The /ralph start command and ralph_start tool accept a file path for the task definition. If a relative path containing directory traversal sequences (e.g., ../) is provided, the skill will resolve it and perform operations outside the intended directory.
The skill uses tryRead on the resolved path and sends the content to the agent's prompt, which could lead to unauthorized data exposure of sensitive local files if used maliciously.
The skill also uses fs.writeFileSync on the resolved path, allowing it to overwrite arbitrary files with controlled content.
[PROMPT_INJECTION]: Indirect prompt injection surface.
The skill iterates through developer tasks by reading markdown files from the local workspace. This creates a surface where malicious instructions embedded in a project's .ralph/ directory could influence agent behavior.
Ingestion points: The task markdown content is read from disk in index.ts inside the start, resume, and ralph_done functions.
Boundary markers: While the constructed prompt uses visual separators, there are no specific instructions or delimiters used to prevent the agent from obeying instructions found within the task file content itself.
Capability inventory: The agent typically has terminal and file system access to perform the tasks in the loop, providing a path for exploitation if the prompt is subverted.
Sanitization: There is no validation or filtering performed on the content of the markdown task files before they are injected into the agent's prompt.

pi-ralph-wiggum