Security risk report for @forgecat/anthropics_claude-code_ralph-wiggum v0.0.4
Source Integrity
Low
Profile claims Anthropic authorship and references official Claude Code plugin repository (github.com/anthropics/claude-code).
License correctly attributes to Anthropic Commercial Terms; source lineage is transparent and traceable.
Agent Intent
Low
Content describes and documents the Ralph Wiggum iterative loop technique; no instructions to ignore system prompts, exfiltrate data, or manipulate the AI's behavior.
The 'CRITICAL RULE' in ralph-loop.md is a guardrail (prevent false completion promises) rather than a manipulation instruction.
No guidance poisoning: recommends no malicious dependencies, weakened security defaults, or backdoored code templates.
Details
Evidence
README.md explains the technique as 'continuous AI loops' with self-referential work via file persistence, not prompt injection.
ralph-loop.md states 'When you try to exit, the Ralph loop will feed the SAME PROMPT back to you' — describes the mechanism transparently.
CRITICAL RULE clause: 'Do not output false promises to escape the loop' — enforces honest completion signaling, not deception.
Permissions
PRM-003Medium
The ralph-loop command is scoped to executing a single setup shell script (./.claude/skills/ralph-wiggum/scripts/setup-ralph-loop.sh), which is a Bash execution permission — a medium-to-high risk category depending on script content.
The cancel-ralph command uses tightly scoped Bash permissions (test -f and rm on a specific file path), which is appropriately minimal for its stated purpose.
The static scanner flagged a stop-hook (./hooks/stop-hook.sh) with no tool-match declaration, meaning a shell hook runs without declared tool constraints — this represents broader authority than explicitly declared, warranting medium concern.
ForgeCat