rails-active-storage
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is primarily educational, providing clear instructions and code snippets for implementing Active Storage in Rails applications. It includes proper security practices such as credential management through Rails credentials and input validation for file uploads.\n- [EXTERNAL_DOWNLOADS]: The documentation in
attaching-files.mdincludes examples of using Ruby'sURI.opento fetch and attach files from remote URLs.\n- [COMMAND_EXECUTION]: Examples infile-operations.mdshow how to use thesystemcall to invoke external binary tools likeffmpegfor media processing on locally stored temporary files.\n- [DYNAMIC_EXECUTION]: The provided scripts (generate_variants.rb,upload_document.rb) utilize Ruby'sconstantizeandpublic_sendmethods to dynamically resolve and interact with application models and attachment methods, which is a standard pattern for administrative CLI tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for processing external files and URLs, which represents an attack surface for indirect prompt injection if the content is later used in LLM prompts.\n - Ingestion points: Controller params in
attaching-files.md,URI.openin examples.\n - Boundary markers: None explicitly mentioned for LLM context.\n
- Capability inventory: Storage writes, file purging, and system command execution as documented in
file-operations.md.\n - Sanitization: The skill provides examples of file type and size validation methods in
examples.mdandsetup-and-configuration.md.
Audit Metadata