ralph-loop-integration
Audited by Socket on Feb 28, 2026
1 alert found:
SecurityThis SKILL document is a design/specification for an iterative, persistent reasoning wrapper (ralph-loop). It does not contain executable code, external downloads, credential requests, or network endpoints. The main security consideration is the stop-hook mechanism and local state persistence: these are legitimate for the stated purpose but are powerful primitives that could be misused if a runtime grants the skill unchecked control over exit behavior or file writes. If implemented faithfully with the listed safeguards (max iterations, timeouts, user overrides, and evidence requirements), the risk is low. Reviewers should ensure implementations: enforce time/iteration bounds, require explicit user consent for persistence and overrides, protect .claude state files from unauthorized reads, and avoid adding networked state-sync or remote installs without review.