use-railway

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill contains instructions to download and execute the Railway CLI installation script from https://railway.com/install.sh and https://agents.railway.com. Since these sources are official domains of the skill's author (Railway), they are verified vendor resources.
  • [COMMAND_EXECUTION]: The skill uses several internal scripts (analyze-postgres.py, dal.py, railway-api.sh, etc.) that execute system commands via subprocess.run or curl. These are used to interact with the Railway CLI and GraphQL API to retrieve logs, metrics, and database status. These operations are essential for the skill's functionality and are properly scoped to the Railway environment.
  • [SAFE]: Static analysis triggers for prompt concealment were identified as false positives. The instructions in the database analysis references (e.g., analyze-db-postgres.md) to not display specific technical limits (CPU/Memory limits) are intended to provide a cleaner and more relevant report for the user, rather than hiding malicious intent. Additionally, the use of Base64 encoding in analyze-postgres.py is a standard technique for safely passing multiline SQL queries to the CLI without shell escaping issues.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 07:21 PM
Security Audit — agent-trust-hub — use-railway