skill-rails-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches release tags and version information from the official Rails GitHub repository and retrieves documentation from the official Ruby on Rails guides and railsdiff.org, which are well-known and standard resources for the Rails ecosystem.
  • [COMMAND_EXECUTION]: The skill utilizes common developer tools including the GitHub CLI (gh), npm, bundle, and rails to automate the discovery of current project versions and to manage dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files to identify current versions and configuration states.
  • Ingestion points: Files like Gemfile, Gemfile.lock, package.json, and config/importmap.rb are read to extract version strings.
  • Boundary markers: No explicit instructions to ignore embedded content within these files are present.
  • Capability inventory: The skill has the capability to execute shell commands (gh, npm, bundle, rails) based on the data found in these files.
  • Sanitization: There is no specific sanitization mentioned for the version strings extracted from the local files before they are used in commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 03:05 PM
Security Audit — agent-trust-hub — skill-rails-upgrade