skills/alisonaquinas/llm-ci-dev/rvm/Gen Agent Trust Hub

rvm

Pass

Audited by Gen Agent Trust Hub on Jul 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads GPG signing keys and the installation script from the official rvm.io domain to ensure secure setup.
  • [REMOTE_CODE_EXECUTION]: Provides instructions to download and execute the RVM installer script from https://get.rvm.io. This follows the official distribution and installation process for the RVM tool.
  • [COMMAND_EXECUTION]: Uses standard shell commands to manage Ruby versions, gemsets, and project dependencies, such as rvm install, rvm use, and bundle install.
  • [PERSISTENCE_MECHANISMS]: The installation process modifies shell profile files (e.g., ~/.bashrc, ~/.zshrc) to integrate RVM into the user's shell environment, which is the expected behavior for this tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles project-level configuration files that determine the environment state.
  • Ingestion points: Reads .ruby-version, .ruby-gemset, and .rvmrc from the local file system (references/project-files.md).
  • Boundary markers: None present.
  • Capability inventory: Executes shell-based environment management via rvm and bundle commands.
  • Sanitization: Relies on the standard parsing and validation logic of the RVM utility.
  • [DYNAMIC_EXECUTION]: Documents the use of .rvmrc files, which execute arbitrary shell code. The skill accurately describes the security model of the tool, noting that users must explicitly trust these files before they are executed.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 8, 2026, 04:18 PM
Security Audit — agent-trust-hub — rvm