TL;DR

Use a quoted heredoc delimiter or an alternative method like printf to safely write user-provided prompt text to the file.

Guidance

• Identify potential security risks: heredoc injection and shell expansion can lead to premature termination or malformed files.
• Consider using a quoted heredoc delimiter to prevent shell expansion, e.g., cat > .claude/ralph-loop.local.md <<'EOF'.
• Alternatively, use printf to write the file content without interpreting the prompt text, e.g., printf '%s' "$PROMPT" > .claude/ralph-loop.local.md.
• Verify the fix by testing with prompt texts containing special characters or the literal string EOF.

Example

cat > .claude/ralph-loop.local.md <<'EOF'
...
$PROMPT
EOF

or

printf '%s' "$PROMPT" > .claude/ralph-loop.local.md

Notes

This fix assumes that the prompt text does not need to be expanded by the shell. If expansion is required, alternative approaches may be necessary.

Recommendation

Apply workaround: use a quoted heredoc delimiter or printf to prevent heredoc injection and shell expansion, as it provides a safe and straightforward solution to the identified security risks.