The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes Railway CLI commands and local shell scripts to manage deployments. It utilizes tool permissions such as Bash(sh *) and Bash(bash *) to run bundled diagnostic and pre-deployment checks.
[EXTERNAL_DOWNLOADS]: The skill downloads the official Railway CLI (@railway/cli) and utilizes agent-browser via npx for verification tasks. These are well-known services and tools appropriate for the skill's operational context.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external log streams (build, deployment, and HTTP logs).
Ingestion points: Application and build logs fetched via railway logs (File: SKILL.md).
Boundary markers: Absent; logs are processed directly into the agent context without delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has access to powerful tools including Bash, Write, and Edit (File: SKILL.md).
Sanitization: No sanitization or filtering is performed on log content before processing.
[DATA_EXFILTRATION]: The skill has the capability to access sensitive environment variables via railway variable list. However, it implements safeguards, including instructions to treat output as confidential and a Python-based filter in scripts/debug.sh that suppresses secret values while displaying variable names.

railway