rails-action-controller
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The scaffolding scripts in the
scripts/directory exhibit a vulnerability surface where untrusted input can influence file system operations. - Ingestion points: The scripts
scripts/api-controller-template.shandscripts/rest-controller-scaffold.shaccept user-provided arguments for controller and model names ($1, $2). - Boundary markers: The scripts lack boundary markers or explicit instructions to ignore potentially malicious embedded characters in the provided names.
- Capability inventory: The scripts possess the capability to create directories (
mkdir), write files (cat), and execute external commands (rails generate). - Sanitization: While the scripts use
sedandtrto format names, they do not sanitize for directory traversal sequences like../. This allows a user to manipulate the$CONTROLLER_FILEpath variable to write generated code into arbitrary directories (e.g.,config/initializers/), bypassing the intendedapp/controllers/scope.
Audit Metadata