create-railcode-app
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches example projects from the vendor's official GitHub repository (Railcode-HQ/railcode-examples) and updates platform skills using npx. It also installs the platform CLI via npm.
- [COMMAND_EXECUTION]: Utilizes the railcode CLI to perform development and deployment workflows, including local environment setup (railcode dev), manifest validation, and publishing to the Railcode platform (railcode deploy).
- [DATA_EXFILTRATION]: Includes a feedback command (railcode agent-feedback) that sends usage data, OS platform details, and Node versions to the vendor's telemetry backend (PostHog). The documentation explicitly warns the user to exclude sensitive credentials or customer data from these reports.
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building applications that process external data from databases, files, and third-party connectors using LLMs. This architecture creates an attack surface for indirect prompt injection within the apps being developed. The skill recommends JSON schema validation for tool arguments as a mitigation. Evidence: 1. Ingestion points: Data is ingested via db, files, and connector calls in server/index.ts. 2. Boundary markers: OpenAPI and JSON schemas are used for validation. 3. Capability inventory: Apps possess db write, file access, egress network calls, and agent execution capabilities. 4. Sanitization: Schema enforcement for LLM output is recommended.
- [DYNAMIC_EXECUTION]: Supports a development workflow where backend worker code is bundled and executed locally using railcode dev. This is a core feature of the platform's development environment for testing worker logic before deployment.
Audit Metadata