ralph-loop
Warn
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The
scripts/kanban.shwrapper script executeseval "$RESOLVED_ENV", where the variables are dynamically generated by the output of a local Python script (controller_resolver.py). This allows for runtime shell environment modification. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The
SKILL.mdfile interpolates user-provided task details via the$ARGUMENTSplaceholder. - Boundary markers: The prompt relies on textual instructions to preserve references literally but lacks robust structural delimiters to isolate user input.
- Capability inventory: The skill can execute shell commands via the
kanban.shscript, perform Git operations, and modify project files. - Sanitization: There is no evidence of input validation or escaping for the data provided in
$ARGUMENTS. - [COMMAND_EXECUTION]: The skill relies on a complex bash wrapper (
scripts/kanban.sh) that manages a virtual environment and executes various CLI tools (yylo-ledger,juno-kanban) and local Python scripts.
Audit Metadata