railway-metrics
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
railway status --jsonto retrieve project identifiers (environmentId, serviceId) necessary for querying metrics. - [COMMAND_EXECUTION]: It calls a local script at
${CLAUDE_PLUGIN_ROOT}/skills/lib/railway-api.shto interact with the Railway GraphQL API. - [DYNAMIC_EXECUTION]: The skill instructions use shell heredocs (
bash <<'SCRIPT') to dynamically construct and execute commands for time calculation, variable preparation, and API interaction. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON output returned by the Railway API. While this data is external, it is restricted to resource usage metrics (CPU, memory, disk) and is processed using
jqfor structured interpretation. - [EXTERNAL_DOWNLOADS]: The skill declares a dependency on
railway-cli, which is the official command-line interface for the Railway platform.
Audit Metadata