Ralph Quick — 10 Iterations (~5-10 min)
Fast security spot-check for pre-deployment or daily security hygiene.
References
Instructions
Execution Engine
YOU MUST follow this loop for EVERY iteration:
- STATE: Read current iteration (start: 1)
- ACTION: Perform ONE check from current phase
- VERIFY: Before reporting FAIL — read actual code, check if a library handles it, check DB constraints, check if dev-only
- REPORT: Output iteration result in the format below
- INCREMENT: iteration = iteration + 1
- CONTINUE: IF iteration <= 10 GOTO Step 1
- FINAL: Generate summary report saved to
.ralph-report.md
Critical rules:
- ONE check per iteration (not all at once)
- ALWAYS show iteration counter
[QUICK-X/10]
- NEVER skip iterations
- If VERIFY is inconclusive: mark
NEEDS_REVIEW, not FAIL
Per-Iteration Output
[QUICK-{N}/10] {check_name}
Target: {file or system component}
Result: {PASS|FAIL|WARN|N/A}
Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}
Finding: {description or "Clean"}
───────────────────────────────
Persona
Senior security engineer — evidence-based, critical focus, maximum efficiency.
Phase Structure
| Iter |
Check |
| 1 |
Auto-detect stack, infra, git sync |
| 2 |
.env in .gitignore check |
| 3 |
Hardcoded secrets scan |
| 4 |
DEBUG mode detection |
| 5 |
SQL injection patterns |
| 6 |
Command injection patterns |
| 7 |
Authentication on sensitive endpoints |
| 8 |
Rate limiting presence |
| 9 |
Container running as root? |
| 10 |
Summary & recommendations |
Auto-Detect (Iteration 1)
Deterministic order:
git rev-parse --show-toplevel- Stack:
package.json, pyproject.toml, requirements.txt, go.mod
- Infra:
Dockerfile, docker-compose.yml, k8s manifests
- CI/CD:
.github/workflows, .gitlab-ci.yml
- Skip non-applicable checks, mark N/A
Confidence Levels
| Level |
Meaning |
| VERIFIED |
Confirmed with code reading or PoC |
| LIKELY |
Strong evidence, no PoC |
| PATTERN_MATCH |
Keyword match only — flag for human review |
| NEEDS_REVIEW |
Inconclusive |
Severity
| Level |
CVSS |
Response |
| CRITICAL |
9.0-10.0 |
Stop and fix immediately |
| HIGH |
7.0-8.9 |
Fix before deployment |
| MEDIUM |
4.0-6.9 |
Schedule fix |
| LOW |
0.1-3.9 |
Note for later |
Report File
On start: if .ralph-report.md exists, rename to .ralph-report-{YYYY-MM-DD-HHmm}.md. Save final report at end.
Parameters
| Param |
Default |
Options |
--iterations |
10 |
1-20 |
--focus |
all |
secrets, owasp, infra, all |
Note: Parameters are AI-interpreted instructions, not parsed CLI args.
When to Use
- Pre-deployment quick check
- Daily security spot-check
- Verifying a specific fix
For deeper audits: /ralph-security (100), /ralph-ultra (1,000), /ralph-promax (10,000).
1---2name: ralph-quick3description: Fast security spot-check with 10 iterations (~5-10 min). Use when user says 'quick security check', 'pre-deploy audit', 'ralph quick', 'fast security scan', 'spot check before deploy', or 'daily security check'. Covers secrets, OWASP basics, auth, rate limiting, and containers.4---56# Ralph Quick — 10 Iterations (~5-10 min)78Fast security spot-check for pre-deployment or daily security hygiene.910## References1112- [Severity definitions](references/severity-guide.md)1314## Instructions1516### Execution Engine1718YOU MUST follow this loop for EVERY iteration:19201. **STATE**: Read current iteration (start: 1)212. **ACTION**: Perform ONE check from current phase223. **VERIFY**: Before reporting FAIL — read actual code, check if a library handles it, check DB constraints, check if dev-only234. **REPORT**: Output iteration result in the format below245. **INCREMENT**: iteration = iteration + 1256. **CONTINUE**: IF iteration <= 10 GOTO Step 1267. **FINAL**: Generate summary report saved to `.ralph-report.md`2728**Critical rules:**29- ONE check per iteration (not all at once)30- ALWAYS show iteration counter `[QUICK-X/10]`31- NEVER skip iterations32- If VERIFY is inconclusive: mark `NEEDS_REVIEW`, not `FAIL`3334### Per-Iteration Output3536```37[QUICK-{N}/10] {check_name}38Target: {file or system component}39Result: {PASS|FAIL|WARN|N/A}40Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW}41Finding: {description or "Clean"}42───────────────────────────────43```4445### Persona4647Senior security engineer — evidence-based, critical focus, maximum efficiency.4849### Phase Structure5051| Iter | Check |52|------|-------|53| 1 | Auto-detect stack, infra, git sync |54| 2 | .env in .gitignore check |55| 3 | Hardcoded secrets scan |56| 4 | DEBUG mode detection |57| 5 | SQL injection patterns |58| 6 | Command injection patterns |59| 7 | Authentication on sensitive endpoints |60| 8 | Rate limiting presence |61| 9 | Container running as root? |62| 10 | Summary & recommendations |6364### Auto-Detect (Iteration 1)6566Deterministic order:671. `git rev-parse --show-toplevel`682. Stack: `package.json`, `pyproject.toml`, `requirements.txt`, `go.mod`693. Infra: `Dockerfile`, `docker-compose.yml`, k8s manifests704. CI/CD: `.github/workflows`, `.gitlab-ci.yml`715. Skip non-applicable checks, mark N/A7273### Confidence Levels7475| Level | Meaning |76|-------|---------|77| VERIFIED | Confirmed with code reading or PoC |78| LIKELY | Strong evidence, no PoC |79| PATTERN_MATCH | Keyword match only — flag for human review |80| NEEDS_REVIEW | Inconclusive |8182### Severity8384| Level | CVSS | Response |85|-------|------|----------|86| CRITICAL | 9.0-10.0 | Stop and fix immediately |87| HIGH | 7.0-8.9 | Fix before deployment |88| MEDIUM | 4.0-6.9 | Schedule fix |89| LOW | 0.1-3.9 | Note for later |9091### Report File9293On start: if `.ralph-report.md` exists, rename to `.ralph-report-{YYYY-MM-DD-HHmm}.md`. Save final report at end.9495### Parameters9697| Param | Default | Options |98|-------|---------|---------|99| `--iterations` | 10 | 1-20 |100| `--focus` | all | secrets, owasp, infra, all |101102Note: Parameters are AI-interpreted instructions, not parsed CLI args.103104### When to Use105106- Pre-deployment quick check107- Daily security spot-check108- Verifying a specific fix109110For deeper audits: `/ralph-security` (100), `/ralph-ultra` (1,000), `/ralph-promax` (10,000).
dvcrn