create-railcode-app

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing the official railcode CLI from the npm registry and adding platform-specific skills from the vendor's GitHub organization (Railcode-HQ/railcode-skills) using npx.
  • [EXTERNAL_DOWNLOADS]: The documentation includes commands to scaffold projects by downloading archived examples from the vendor's official GitHub repository (Railcode-HQ/railcode-examples) using curl and tar.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the railcode CLI for local development (railcode dev), secret management (railcode secrets), and application deployment (railcode deploy). These operations are the primary intended functions of the development tool and are executed within a standard developer workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for building applications that process external data and user input. It provides specific security guidance to mitigate prompt injection and data exposure risks, such as enforcing identity verification via ctx.user (a verified server-side context) and utilizing managed agents with isolated sandboxes for processing untrusted file content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 10:00 AM
Security Audit — agent-trust-hub — create-railcode-app