ralph-plot-sprint
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection from untrusted external sources.
- Ingestion points: Processes pull request comments and code diffs using
gh apiandgh pr diffas described inSKILL.md(Steps 0, 1, and 4). - Boundary markers: Absent. External content from GitHub is processed without delimiters or isolation instructions.
- Capability inventory: High-privilege operations including
git push --force-with-lease,gh pr merge, and arbitrary code/test execution during task implementation inSKILL.md. - Sanitization: Absent. Untrusted data is not validated or sanitized before being incorporated into the prompt context.
- [COMMAND_EXECUTION]: Performs high-impact version control and system operations.
- Repository modification: Executes
git push --force-with-leaseandgh pr merge, which can alter repository history and state. - Confirmation Bypass: The runner script
ralph-sprint.shinvokes the agent with the--dangerously-skip-permissionsflag, removing human oversight for sensitive actions. - [DATA_EXFILTRATION]: Transmits iteration summaries to a user-configured external server.
- Mechanism: The
ralph-sprint.shscript sends data to anntfyserver usingcurland environment-provided credentials. - Vulnerability: An attacker could potentially influence the content of these summaries via indirect prompt injection to exfiltrate information from the execution environment.
Audit Metadata