← 返回 Skills 市场
Ralph Loops
作者
qlifebot-coder
· GitHub ↗
· v1.0.2
6440
总下载
1
收藏
0
当前安装
3
版本数
在 OpenClaw 中安装
/install ralph-loops
功能描述
Runs autonomous iterative AI loops for requirements, planning, or building phases using structured prompts and fresh context per iteration.
安全使用建议
Install only if you are comfortable running an autonomous coding loop with broad local authority. Use a disposable branch or isolated VM/container, provide only task-specific credentials, disable or restrict the dashboard to loopback with authentication, review diffs before any push or tag, and do not run it in repositories or workspaces containing sensitive files until the dashboard command-injection/XSS and unauthenticated control issues are fixed.
功能分析
Type: OpenClaw Skill
Name: ralph-loops
Version: 1.0.2
This skill is classified as suspicious due to its reliance on `--dangerously-skip-permissions` for the Claude CLI, which grants the AI agent full system access, bypassing all built-in safeguards. Additionally, the `scripts/ralph-loop.mjs` script includes a `checkCmd` argument that allows arbitrary command execution via `execSync`, creating a direct command injection vector if the agent's arguments can be manipulated. The skill also instructs the agent to perform `git push` operations and use the `browser` tool to open URLs (e.g., `browser action=open targetUrl="http://localhost:PORT"`), which are powerful capabilities that, while intended for development, significantly increase the attack surface for prompt injection or misuse. These risky capabilities are present in `SKILL.md`, `scripts/ralph-loop.mjs`, `templates/loop.sh`, and `templates/PROMPT_build.md`.
能力评估
Credentials
The documentation recommends Docker or VM isolation, reduced credentials, and restricted network access, but the implementation does not enforce those boundaries. The runner uses ~/clawd as its working directory, state is stored in /tmp, and the dashboard enables permissive CORS without authentication.
Install Mechanism
Installation uses ordinary npm dependencies for the dashboard and documented Claude Code setup. The lockfile includes path-to-regexp 0.1.12 via Express, which is a dependency risk for an HTTP dashboard but not evidence of malicious packaging.
Instruction Scope
The skill discloses that autonomous mode bypasses permissions, but the default examples and templates do not require a scoped project directory, review gate, or explicit approval before high-impact actions such as remote pushes, tags, and dashboard kill operations.
Persistence & Privilege
The skill writes state and done markers in /tmp, archives histories under ~/clawd/logs/ralph-archive, reads local Clawdbot transcript files, exposes process termination, and mutates Git state. These behaviors fit the purpose but carry high impact without strong containment.
Purpose & Capability
The purpose is coherent: iterative autonomous development with a monitoring dashboard. However, the shipped runner and templates intentionally launch Claude with permission checks bypassed, can edit the workspace, and can automatically commit, push, and tag repository changes.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install ralph-loops - 安装完成后，直接呼叫该 Skill 的名称或使用
/ralph-loops触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.2
Added warning: don't block conversation while monitoring loops
v1.0.1
Added credits/attribution
v1.0.0
Initial release: autonomous building with Geoffrey Huntley methodology
元数据
常见问题
Ralph Loops 是什么？
Runs autonomous iterative AI loops for requirements, planning, or building phases using structured prompts and fresh context per iteration. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 6440 次。
如何安装 Ralph Loops？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install ralph-loops」即可一键安装，无需额外配置。
Ralph Loops 是免费的吗？
是的，Ralph Loops 完全免费（开源免费），可自由下载、安装和使用。
Ralph Loops 支持哪些平台？
Ralph Loops 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Ralph Loops？
由 qlifebot-coder（@qlifebot-coder）开发并维护，当前版本 v1.0.2。
推荐 Skills