OpenClaw

ralph-quick

Fast security spot-check with 10 iterations (~5-10 min). Use when user says 'quick security check', 'pre-deploy audit', 'ralph quick', 'fast security scan', 'spot check before deploy', or 'daily security check'. Covers secrets, OWASP basics, auth, rate limiting, and containers.

dorukardahan0 来源安装数☆ 0 仓库 Stars

查看来源 ↗安装与使用 SKILL.md ↗

安装与使用

请根据来源仓库和你的 AI 工具说明安装此技能。先阅读技能文件和依赖要求，再添加到工作流。

SkillHub CLI

skillhub install dorukardahan/ralph-quick

打开来源仓库，查看说明和兼容环境后，按来源提供的命令或步骤安装。

将来源链接提供给你的 Agent，让它先读取说明、核对依赖，并向你说明将执行的安装步骤。

查看来源 ↗使用指南

技能说明

Ralph Quick — 10 Iterations (~5-10 min)

Fast security spot-check for pre-deployment or daily security hygiene.

References

Severity definitions

Instructions

Execution Engine

YOU MUST follow this loop for EVERY iteration:

STATE: Read current iteration (start: 1)
ACTION: Perform ONE check from current phase
VERIFY: Before reporting FAIL — read actual code, check if a library handles it, check DB constraints, check if dev-only
REPORT: Output iteration result in the format below
INCREMENT: iteration = iteration + 1
CONTINUE: IF iteration <= 10 GOTO Step 1
FINAL: Generate summary report saved to .ralph-report.md

Critical rules:

ONE check per iteration (not all at once)
ALWAYS show iteration counter [QUICK-X/10]
NEVER skip iterations
If VERIFY is inconclusive: mark NEEDS_REVIEW, not FAIL

Per-Iteration Output

[QUICK-{N}/10] {check_name}
Target: {file or system component}
Result: {PASS|FAIL|WARN|N/A}
Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}
Finding: {description or "Clean"}
───────────────────────────────

Persona

Senior security engineer — evidence-based, critical focus, maximum efficiency.

Phase Structure

Iter	Check
1	Auto-detect stack, infra, git sync
2	.env in .gitignore check
3	Hardcoded secrets scan
4	DEBUG mode detection
5	SQL injection patterns
6	Command injection patterns
7	Authentication on sensitive endpoints
8	Rate limiting presence
9	Container running as root?
10	Summary & recommendations

Auto-Detect (Iteration 1)

Deterministic order:

git rev-parse --show-toplevel
Stack: package.json, pyproject.toml, requirements.txt, go.mod
Infra: Dockerfile, docker-compose.yml, k8s manifests
CI/CD: .github/workflows, .gitlab-ci.yml
Skip non-applicable checks, mark N/A

Confidence Levels

| Le...

来源信息

Source: github
Repository: openclaw/skills
Path: skills/dorukardahan/ralph-quick
Version: —
Commit: e241cdb2162327f45a5695169682142d26619563
分类来源: rules
状态: active
可见性: public

这些信息来自收录时的来源分析，可能滞后；使用前请核对最新来源文件。

来源内容

SKILL.md

# Ralph Quick — 10 Iterations (~5-10 min)

Fast security spot-check for pre-deployment or daily security hygiene.

## References

- [Severity definitions](references/severity-guide.md)

## Instructions

### Execution Engine

YOU MUST follow this loop for EVERY iteration:

1. **STATE**: Read current iteration (start: 1)
2. **ACTION**: Perform ONE check from current phase
3. **VERIFY**: Before reporting FAIL — read actual code, check if a library handles it, check DB constraints, check if dev-only
4. **REPORT**: Output iteration result in the format below
5. **INCREMENT**: iteration = iteration + 1
6. **CONTINUE**: IF iteration <= 10 GOTO Step 1
7. **FINAL**: Generate summary report saved to `.ralph-report.md`

**Critical rules:**
- ONE check per iteration (not all at once)
- ALWAYS show iteration counter `[QUICK-X/10]`
- NEVER skip iterations
- If VERIFY is inconclusive: mark `NEEDS_REVIEW`, not `FAIL`

### Per-Iteration Output

```
[QUICK-{N}/10] {check_name}
Target: {file or system component}
Result: {PASS|FAIL|WARN|N/A}
Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}
Finding: {description or "Clean"}
───────────────────────────────
```

### Persona

Senior security engineer — evidence-based, critical focus, maximum efficiency.

### Phase Structure

| Iter | Check |
|------|-------|
| 1 | Auto-detect stack, infra, git sync |
| 2 | .env in .gitignore check |
| 3 | Hardcoded secrets scan |
| 4 | DEBUG mode detection |
| 5 | SQL injection patterns |
| 6 | Command injection patterns |
| 7 | Authentication on sensitive endpoints |
| 8 | Rate limiting presence |
| 9 | Container running as root? |
| 10 | Summary & recommendations |

### Auto-Detect (Iteration 1)

Deterministic order:
1. `git rev-parse --show-toplevel`
2. Stack: `package.json`, `pyproject.toml`, `requirements.txt`, `go.mod`
3. Infra: `Dockerfile`, `docker-compose.yml`, k8s manifests
4. CI/CD: `.github/workflows`, `.gitlab-ci.yml`
5. Skip non-applicable checks, mark N/A

### Confidence Levels

| Le...

搜索