skill-rails-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches release tags and version information from the official Rails GitHub repository and retrieves documentation from the official Ruby on Rails guides and railsdiff.org, which are well-known and standard resources for the Rails ecosystem.
- [COMMAND_EXECUTION]: The skill utilizes common developer tools including the GitHub CLI (
gh),npm,bundle, andrailsto automate the discovery of current project versions and to manage dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files to identify current versions and configuration states.
- Ingestion points: Files like
Gemfile,Gemfile.lock,package.json, andconfig/importmap.rbare read to extract version strings. - Boundary markers: No explicit instructions to ignore embedded content within these files are present.
- Capability inventory: The skill has the capability to execute shell commands (
gh,npm,bundle,rails) based on the data found in these files. - Sanitization: There is no specific sanitization mentioned for the version strings extracted from the local files before they are used in commands.
Audit Metadata