heating the forge...

@forgecat/cursor_plugins_ralph-loop — Security Risk Report | ForgeCat

cursor_plugins_ralph-loop

Security risk report for @forgecat/cursor_plugins_ralph-loop v0.0.10

Low

Profile claims origin from Cursor's official plugin repository (https://github.com/cursor/plugins/tree/main/ralph-loop) with specific commit hash (889ec4b68fa5aab0e867dad71ec3fdf386ae48f3).
Metadata includes MIT license and platform compatibility table; no suspicious external dependencies or typosquatted packages.

Low

Content describes and documents the Ralph Loop technique (iterative self-referential prompting) as a legitimate development methodology; no hidden instructions to manipulate the AI into ignoring its system prompt or performing unauthorized actions.
Skill definitions are transparent about their function (start loop, cancel loop, explain technique); guardrails in ralph-loop skill explicitly warn against false promises and recommend safety limits (max_iterations).
No guidance poisoning: the profile does not instruct weakening security defaults, installing backdoored dependencies, or systematically steering outputs toward attacker goals.

Details

Evidence

README: 'Ralph Loop runs Cursor in a self-referential loop, feeding the same prompt back after every turn until the task is complete.'
ralph-loop SKILL.md guardrails: 'If a completion promise is set, you may ONLY output <promise>TEXT</promise> when the statement is completely and genuinely true. Do not output false promises to escape the loop.'
ralph-loop SKILL.md: 'Always recommend setting max_iterations as a safety net.'

PRM-003Medium

The static scanner flagged three shell hook scripts (afterAgentResponse, stop, followup-stop portable) that are not matched to declared tools, meaning they execute shell logic outside the visible tool inventory — this is a moderate authority concern.
The hooks intercept agent lifecycle events (turn end, stop) and inject follow-up messages autonomously, which is broader authority than a simple skill invocation and could be abused if the hook content were malicious.
However, the stated purpose (iterative loop automation) is consistent with needing lifecycle hooks, and no high-risk categories (arbitrary file write outside .cursor/ralph, network exfiltration, shell escalation) are evident in the described behavior.

Details

Findings

Evidence

[permissions/hook-no-tool-match] ./hooks/generated-cursor-afteragentresponse-ordered.sh

Low

No MCP servers declared in the profile; no external binary execution or network access configured.
Dependencies listed (jq) are standard Unix utilities with no hidden instructions or arbitrary code execution.

Details

Evidence

Profile section 'MCP servers (untrusted data)': (none)
README Dependencies: 'jq is required by the hook handlers and the portable Stop adapters.'