create-railcode-app
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for downloading and installing the official
railcodeCLI from the npm registry and adding platform-specific skills from the vendor's GitHub organization (Railcode-HQ/railcode-skills) usingnpx. - [EXTERNAL_DOWNLOADS]: The documentation includes commands to scaffold projects by downloading archived examples from the vendor's official GitHub repository (
Railcode-HQ/railcode-examples) usingcurlandtar. - [COMMAND_EXECUTION]: The skill makes extensive use of the
railcodeCLI for local development (railcode dev), secret management (railcode secrets), and application deployment (railcode deploy). These operations are the primary intended functions of the development tool and are executed within a standard developer workflow. - [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for building applications that process external data and user input. It provides specific security guidance to mitigate prompt injection and data exposure risks, such as enforcing identity verification via
ctx.user(a verified server-side context) and utilizing managed agents with isolated sandboxes for processing untrusted file content.
Audit Metadata