ruby-on-rails
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive guidelines for secure Ruby on Rails 8.1 development. It explicitly mandates security best practices such as using strong parameters for controller inputs, enforcing server-side authorization (e.g., Pundit, ActionPolicy), and utilizing SQL query methods with binds to prevent injection attacks.
- [SAFE]: The instructions specifically address and mitigate Insecure Direct Object Reference (IDOR) vulnerabilities by recommending resource scoping (e.g.,
Current.user.posts.find(params[:id])) rather than global lookups. - [SAFE]: Credential management follows industry standards, instructing the agent to use
Rails.application.credentialsor environment variables and strictly forbidding the committal of keys to version control. - [SAFE]: The skill encourages the use of established tools and libraries (Propshaft, Hotwire, Solid Queue, Kamal) without introducing unverifiable dependencies or remote code execution risks.
Audit Metadata