The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script scripts/ralph-loop-example.py uses subprocess.Popen and subprocess.run to execute system commands. Specifically, it invokes opencode run with agent-supplied content and performs Git operations (git add, git commit). While functional for a developer tool, this allows the agent to execute shell commands within the project environment.
[PROMPT_INJECTION]: The skill documents and provides templates for an 'Adversary Sub-Agent' (in HIERARCHICAL_AGENTS.md and PROMPT-ADVERSARY.md). These instructions use adversarial framing, such as 'BREAK the implementation,' 'Take the role of an attacker,' and 'Assume the code is WRONG until proven otherwise.' While intended for security verification, this uses role-play and jailbreak-style patterns to bypass typical AI safety constraints.
[INDIRECT_PROMPT_INJECTION]: The Ralph Loop engine possesses a significant attack surface as it is designed to ingest and process data from TODO.md, SPEC.md, and project source files.
Ingestion points: Reads TODO.md, SPEC.md, AGENTS.md, and the entire project codebase.
Boundary markers: Relies on standard Markdown headers; no explicit security delimiters or sanitization for embedded instructions are present.
Capability inventory: The engine can write files, execute shell commands (via opencode), perform Git operations, and send network requests (via the Slack plugin example).
Sanitization: There is no evidence of sanitization or filtering for instructions embedded within the processed project files.
[EXTERNAL_DOWNLOADS]: The scripts/generate-ralph-loop.sh generator script bootstraps a project environment that depends on several external Python packages, including pyyaml, pydantic, structlog, pluggy, and OpenTelemetry components. It also references the wojons/skills repository for installation via npx.

ralph-wiggum-loop