rails-active-storage

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is primarily educational, providing clear instructions and code snippets for implementing Active Storage in Rails applications. It includes proper security practices such as credential management through Rails credentials and input validation for file uploads.\n- [EXTERNAL_DOWNLOADS]: The documentation in attaching-files.md includes examples of using Ruby's URI.open to fetch and attach files from remote URLs.\n- [COMMAND_EXECUTION]: Examples in file-operations.md show how to use the system call to invoke external binary tools like ffmpeg for media processing on locally stored temporary files.\n- [DYNAMIC_EXECUTION]: The provided scripts (generate_variants.rb, upload_document.rb) utilize Ruby's constantize and public_send methods to dynamically resolve and interact with application models and attachment methods, which is a standard pattern for administrative CLI tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture for processing external files and URLs, which represents an attack surface for indirect prompt injection if the content is later used in LLM prompts.\n
  • Ingestion points: Controller params in attaching-files.md, URI.open in examples.\n
  • Boundary markers: None explicitly mentioned for LLM context.\n
  • Capability inventory: Storage writes, file purging, and system command execution as documented in file-operations.md.\n
  • Sanitization: The skill provides examples of file type and size validation methods in examples.md and setup-and-configuration.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 01:35 PM