railway
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the Railway GraphQL API andjqto parse the JSON responses. These are standard operations for the skill's intended purpose of managing cloud infrastructure. - [CREDENTIALS_UNSAFE]: The skill properly handles the
$RAILWAY_TOKENenvironment variable. It includes an explicit warning to never echo the variable directly and provides a remediation path using a setup tool (teleport-setup add-key railway) rather than suggesting manual edits to configuration files. - [EXTERNAL_DOWNLOADS]: References the
backboard.railway.comGraphQL endpoint, which is the official domain for Railway's API services. This is a well-known service and does not escalate the security risk.
Audit Metadata