rvm
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads GPG signing keys and the installation script from the official
rvm.iodomain to ensure secure setup. - [REMOTE_CODE_EXECUTION]: Provides instructions to download and execute the RVM installer script from
https://get.rvm.io. This follows the official distribution and installation process for the RVM tool. - [COMMAND_EXECUTION]: Uses standard shell commands to manage Ruby versions, gemsets, and project dependencies, such as
rvm install,rvm use, andbundle install. - [PERSISTENCE_MECHANISMS]: The installation process modifies shell profile files (e.g.,
~/.bashrc,~/.zshrc) to integrate RVM into the user's shell environment, which is the expected behavior for this tool. - [INDIRECT_PROMPT_INJECTION]: The skill handles project-level configuration files that determine the environment state.
- Ingestion points: Reads
.ruby-version,.ruby-gemset, and.rvmrcfrom the local file system (references/project-files.md). - Boundary markers: None present.
- Capability inventory: Executes shell-based environment management via
rvmandbundlecommands. - Sanitization: Relies on the standard parsing and validation logic of the RVM utility.
- [DYNAMIC_EXECUTION]: Documents the use of
.rvmrcfiles, which execute arbitrary shell code. The skill accurately describes the security model of the tool, noting that users must explicitly trust these files before they are executed.
Audit Metadata