Plugin Settings
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill documents an 'agent loop' pattern (referenced as 'Ralph loop') where instructions are read from the markdown body of a local project file and fed back to the agent as a 'reason' for a blocked session exit. While this creates a surface for indirect prompt injection if an untrusted party modifies the file, the skill provides guidance on safe implementation.\n
- Ingestion points: .claude/*.local.md files (e.g., ralph-loop.local.md).\n
- Boundary markers: Uses standard markdown structure; no specialized security delimiters for the injected prompt are specified in the templates.\n
- Capability inventory: Extracted content influences the agent's next turn via the 'reason' field in hook decision outputs.\n
- Sanitization: Documentation explicitly recommends using jq with --arg for safe JSON construction and escaping of user-provided content.\n- [COMMAND_EXECUTION]: Includes bash scripts (scripts/parse-frontmatter.sh, scripts/validate-settings.sh) and hook examples that use standard utilities like sed, grep, awk, and jq to parse configuration files. These scripts utilize best practices such as variable quoting and atomic file updates to ensure stability.\n- [EXTERNAL_DOWNLOADS]: Mentions yq as an optional dependency for complex YAML parsing and recommends installation through trusted package managers like Homebrew.
Audit Metadata