railway
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts with Railway.app using the official GraphQL API at backboard.railway.com. It relies exclusively on the Ruby standard library, which minimizes the attack surface by avoiding external third-party dependencies.
- [CREDENTIALS_UNSAFE]: The skill implements secure handling of the Railway API token. In
scripts/save_token.rb, it validates the token against the API and stores it in a dedicated configuration directory (~/.config/railway/token) with restricted file permissions (0600), ensuring it is not accessible to other users on the host system. - [COMMAND_EXECUTION]: The skill's functionality is encapsulated in a series of Ruby scripts. Analysis of these scripts confirms they do not use unsafe execution methods like
eval,system, or backticks with unsanitized user input. API parameters are passed safely as GraphQL variables. - [EXTERNAL_DOWNLOADS]: All network operations are directed to the official Railway API domain. No suspicious downloads or remote code execution patterns from untrusted sources were detected.
Audit Metadata