| name | ralph-promax |
| description | Maximum paranoia security audit with 10,000 iterations (~2-5 days) using 8 expert personas. Use when user says 'ralph promax', 'maximum security audit', 'full paranoia audit', 'exhaustive security review', 'security incident deep investigation', or 'maximum paranoia mode'. Covers OWASP, supply chain, API, containers, CI/CD, performance, AI/RAG, compliance. Use when this capability is needed. |
| metadata | {"author":"dorukardahan"} |
Ralph Promax — 10,000 Iterations (~2-5 days)
The most exhaustive security audit. 8 expert personas, 16 phases, leave nothing unexamined.
Host Safety Warning: Promax includes system-level reconnaissance (process listing, port scanning, file permissions). Runs with YOUR user's permissions. Do NOT run on production servers without understanding implications.
References
Instructions
Execution Engine
YOU MUST follow this loop for EVERY iteration — NO EXCEPTIONS:
- STATE: Read current iteration (start: 1)
- PHASE: Determine phase from iteration number
- MIND: Activate appropriate expert persona
- DEPTH: Apply maximum thoroughness
- ACTION: Perform ONE check — DEEPLY and THOROUGHLY
- VERIFY: Before FAIL — read actual code, check libraries, DB constraints, environment. If inconclusive:
NEEDS_REVIEW.
- EXPLOIT: Attempt to exploit if vulnerability found
- REPORT: Output iteration result with PoC
- SAVE: Every 100 iterations, update
.ralph-report.md
- INCREMENT: iteration + 1
- CONTINUE: IF iteration <= 10000 GOTO Step 1
- FINAL: Generate comprehensive report
Critical rules:
- ONE check per iteration — DEEP not WIDE
- ALWAYS show
[PROMAX-X/10000]
- NEVER skip iterations
- CRITICAL findings: STOP and demand immediate attention
- Red Team question for EVERY check
- Apply ALL 8 Minds to complex findings
Per-Iteration Output
╔════════════════════════════════════════════════════════════════════════╗
║ [PROMAX-{N}/10000] Phase {P}: {phase_name} ║
║ Mind: {active_expert_persona} ║
║ Depth Level: ████████████ MAXIMUM ║
╠════════════════════════════════════════════════════════════════════════╣
║ Check: {specific_check} ║
║ Target: {file:line / endpoint / system / dependency} ║
╠════════════════════════════════════════════════════════════════════════╣
║ Red Team Question: "{attack scenario being tested}" ║
╠════════════════════════════════════════════════════════════════════════╣
║ Result: {PASS|FAIL|WARN|SUSPICIOUS|N/A} ║
║ Confidence: {VERIFIED|LIKELY|PATTERN_MATCH|NEEDS_REVIEW} ║
║ Severity: {CRITICAL|HIGH|MEDIUM|LOW|INFO} ║
║ CVSS: {score} | Exploitability: {TRIVIAL|MODERATE|DIFFICULT} ║
╠════════════════════════════════════════════════════════════════════════╣
║ Finding: {detailed description} ║
║ Attack Vector: {how an attacker would exploit} ║
║ Proof of Concept: {actual exploit code/steps or "N/A"} ║
║ Blast Radius: {what gets compromised} ║
║ Fix: {specific remediation with code} ║
╠════════════════════════════════════════════════════════════════════════╣
║ Progress: [████████░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░] {N/100}% ║
║ Phase: {current}/{16} | ETA: ~{days}d {hours}h ║
╚════════════════════════════════════════════════════════════════════════╝
The Eight Minds
| Phase | Expert Mind |
|---|
| 1 | Cybersecurity Veteran + CI/CD Saboteur |
| 2 | Code Auditor (Pentester) |
| 3 | Cybersecurity Veteran |
| 4 | Container Security Expert |
| 5 | Code Auditor |
| 6 | Dependency Hunter |
| 7 | API Security Specialist |
| 8 | Container Security Expert |
| 9 | CI/CD Saboteur |
| 10 | Performance Engineer |
| 11 | RAG System Architect |
| 12 | Cybersecurity Veteran |
| 13-16 | All 8 Minds |
Core Philosophy
- DEFENSE IN DEPTH — one control = zero controls
- FAIL SECURE — when uncertain, DENY
- LEAST PRIVILEGE — every permission is an attack vector
- TRUST NOTHING — verify EVERYTHING
- ASSUME BREACH — they're already inside
- THOROUGHNESS IS SURVIVAL
Phase Structure (10,000 Iterations)
| Phase | Iterations | Focus Area |
|---|
| 1 | 1-500 | Reconnaissance & Attack Surface |
| 2 | 501-1,200 | OWASP Top 10 Deep Dive |
| 3 | 1,201-2,000 | Authentication & Secrets |
| 4 | 2,001-2,800 | Infrastructure & Network |
| 5 | 2,801-3,600 | Code Quality & Business Logic |
| 6 | 3,601-4,400 | Supply Chain & Dependencies |
| 7 | 4,401-5,200 | API Security Deep Dive |
| 8 | 5,201-6,000 | Container & Docker Security |
| 9 | 6,001-6,800 | CI/CD Pipeline Security |
| 10 | 6,801-7,600 | Performance & DoS Resilience |
| 11 | 7,601-8,400 | AI/RAG System Security |
| 12 | 8,401-9,000 | Compliance & Privacy |
| 13 | 9,001-9,400 | Cross-Cutting Attack Chains |
| 14 | 9,401-9,700 | Penetration Test Simulation |
| 15 | 9,701-9,900 | Final Verification |
| 16 | 9,901-10,000 | Report & Summary |
For detailed per-phase iteration breakdowns, checklists, and attack payloads, consult references/phase-details.md and references/attack-patterns.md.
Auto-Detect (Iteration 1)
git rev-parse --show-toplevel, git remote -v- Stack:
package.json, pyproject.toml, requirements.txt, go.mod, Cargo.toml, pom.xml, build.gradle, composer.json
- Infra:
Dockerfile, docker-compose.yml, k8s, terraform, serverless
- Services: enumerate containers/k8s services
- CI/CD:
.github/workflows, .gitlab-ci.yml, .circleci
- Production URL: env/config/docs/ingress
- Deployment host: SSH config, deploy scripts
Report File
On start: rename existing report. Auto-save every 100 iterations.
Parameters
| Param | Default | Options |
|---|
--iterations | 10000 | 1-20000 |
--focus | all | recon, owasp, auth, infra, code, supply-chain, api, docker, cicd, perf, rag, compliance, all |
--phase | all | 1-16 |
--paranoia | maximum | standard, high, maximum |
--resume | — | Continue from checkpoint |
Context Limit Protocol
- IMMEDIATELY checkpoint to report file
- Output:
AUDIT CHECKPOINT at iteration {N}. Resume with: /ralph-promax --resume
- Include: findings summary, next phase
- Wait for new session
When to Use
- Security incident investigation
- Compliance audit preparation
- Maximum paranoia mode
- After
/ralph-ultra finds concerning patterns
Converted and distributed by TomeVault — claim your Tome and manage your conversions.
