Trust Assessment
steve received a trust score of 25/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 4 findings: 1 critical, 3 high, 0 medium, and 0 low severity. Key findings include Unpinned external package installation, Unpinned git clone and arbitrary script execution, Overly broad Bash permissions with wildcards.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 25/100, indicating areas for improvement.
Last analyzed on June 1, 2026 (commit e47452f4). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Unpinned git clone and arbitrary script execution The skill instructs the agent to clone a git repository (`https://github.com/frankbria/ralph-claude-code.git`) and immediately execute an `install.sh` script from it. The clone operation does not specify a particular commit hash, tag, or branch, meaning it will pull the latest version of the `main` branch. This is a critical supply chain vulnerability, as a malicious change to the `ralph-claude-code` repository could lead to arbitrary code execution on the host system without any review or confirmation. 1. Avoid direct execution of scripts from unpinned external repositories. 2. If absolutely necessary, clone a specific, immutable commit hash or tag. 3. Review the `install.sh` script thoroughly before allowing its execution. 4. Consider sandboxing the installation process. | Static | SKILL.md:299 | |
| HIGH | Unpinned external package installation The skill instructs the agent to automatically install external npm packages for skills and MCP servers using `npx skills add ... -y` and `claude mcp add ... npx -y ...`. These commands install the latest version of the packages without pinning to a specific version or checking integrity. This introduces a supply chain risk where a compromised package or a malicious update to a legitimate package could lead to arbitrary code execution on the host system. The `npx skills find` command could also suggest skills from less reputable sources. 1. Require explicit user confirmation before installing any external packages, especially those not from a trusted, curated list. 2. If auto-installation is necessary, pin package versions (e.g., `@upstash/context7-mcp@1.2.3`) to ensure reproducibility and prevent unexpected updates. 3. Implement integrity checks (e.g., checksums) for installed packages. 4. Carefully vet the sources of skills suggested by `npx skills find` and only recommend trusted ones. | Static | SKILL.md:67 | |
| HIGH | Overly broad Bash permissions with wildcards The `settings.local.json` and `.ralphrc` configurations grant the agent excessively broad `Bash` permissions using `*` wildcards (e.g., `Bash(npm *)`, `Bash(git *)`, `Bash(python *)`). This allows the agent to execute any command that starts with the specified prefix, effectively bypassing granular control. For example, `Bash(npm *)` would allow `npm install malicious-package` or `npm run evil-script`. While a development agent requires significant access, these wildcards create a large attack surface for command injection or unintended actions if the agent's output is compromised or if it misinterprets instructions. `Skill(*)` also grants access to all skills, which, combined with the supply chain risks, is problematic. 1. Replace `Bash(*)` wildcards with a more restrictive list of specific commands and arguments (e.g., `Bash(npm install)`, `Bash(git clone)`, `Bash(python -m venv)`). 2. If wildcards are unavoidable, implement strict input validation and sanitization for any arguments passed to these Bash commands. 3. Review the necessity of `Skill(*)` and consider granting access to only specific, required skills. | Static | SKILL.md:113 | |
| HIGH | Potential command injection via unsanitized project name The skill sets the `PROJECT_NAME` variable in `.ralphrc` directly from the `$ARGUMENTS` variable, which is derived from user input (`[project description or path]`). If `$ARGUMENTS` contains shell metacharacters (e.g., `"; rm -rf /"`), and `PROJECT_NAME` is later used in an unsanitized shell command or parsed by `ralph-loop` in a vulnerable way, it could lead to command injection. 1. Sanitize `$ARGUMENTS` before assigning it to `PROJECT_NAME`, escaping any shell metacharacters. 2. Ensure that any downstream processes (like `ralph-loop`) that consume `PROJECT_NAME` treat it as literal data and do not interpret it as executable code. | Static | SKILL.md:306 |
Scan History
Embed Code
[](https://skillshield.io/report/09e86a60808e54c4)
Powered by SkillShield