setup-ralph-loop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-ralph-loop (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create the local scripts and repo conventions needed to run Ralph safely.
This is an infrastructure skill, not a normal feature-delivery stage.
Use /setup-ralph-loop when a project wants to run /execute in a repeatable HITL-to-AFK loop.
Auto-invocation: /execute automatically invokes this skill when it detects multi-slice GitHub-issue work (PRD, big-batch appetite, or multiple user stories) and no ralph-once.sh or ralph.sh exists in the repo root. This means the skill may be entered without the user explicitly calling it — the detection and invocation happen as a prerequisite step inside /execute.
Do not use it as part of the default feature pipeline. It prepares the repo so later /execute execution can run under Ralph with bounded iterations, explicit feedback loops, and durable GitHub-backed state.
/execute, not a separate workflow.progress.txt or other local task-state files.Ask where Ralph should read work from.
Prefer this order:
If the repo uses GitHub issues, keep Ralph GitHub-native:
Do not introduce progress.txt as durable state unless the user explicitly chooses to deviate from the repo's GitHub-first model.
Inspect the target repo before generating scripts.
Check for available commands in package.json or equivalent tooling:
typechecktestlintbuildAlso note whether the repo already has:
/setup-pre-commitThe generated Ralph prompt should only name feedback loops that actually exist.
Ask whether Ralph should run:
pnpmDefault recommendation:
ralph-once.shCreate a one-iteration script for supervised use first.
The script should:
/executeSuggested shape:
#!/bin/bash
set -e
claude --message "Look at the open GitHub issues. Pick the highest-risk unblocked issue that still needs implementation, respecting blocking relationships. Use /execute to implement exactly one reviewable slice. Run the repo's feedback loops. If all issue work is complete, say DONE and stop."Adapt the prompt to the actual task source and available commands.
ralph.shCreate a bounded AFK loop.
The script must:
while trueralph-once.shSuggested shape:
#!/bin/bash
set -e
if [ -z "$1" ]; then
echo "Usage: $0 <iterations>"
exit 1
fi
for ((iteration=1; iteration<=$1; iteration++)); do
claude --message "Look at the open GitHub issues. Pick the highest-risk unblocked issue that still needs implementation, respecting blocking relationships. Use /execute to implement exactly one reviewable slice. Run the repo's feedback loops. If all issue work is complete, say DONE and stop."
echo "Ralph iteration $iteration complete."
doneIf the user wants, also add convenience scripts to package.json, for example:
{
"scripts": {
"ralph:once": "./ralph-once.sh",
"ralph": "./ralph.sh 5"
}
}Use a small default iteration count if adding a package script.
Make sure the generated loop prompt states the repo's quality expectations clearly.
The prompt should say Ralph must:
/execute "AFK progress and plateau detection" and references/SYSTEM-OVERVIEW.md (bundled alongside this skill) for the full rule.If the repo is clearly long-lived production code, say so explicitly in the prompt.
Check:
ralph-once.sh exists and is executableralph.sh exists and is executableprogress.txt was introduced unless the user explicitly asked for itOn completion: Create the Ralph marker so enforcement hooks know setup was done.
mkdir -p "$CLAUDE_PROJECT_DIR/.claude" && touch "$CLAUDE_PROJECT_DIR/.claude/.ralph-checked"Instruct the user to:
./ralph-once.sh first./ralph.sh 5Before considering setup complete, check:
/execute/execute/execute, /pre-merge, and GitHub-issue-based execution by making AFK work safer and more repeatableralph-once.sh, then by using bounded AFK Ralph when the setup proves reliable~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.