action-cable
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to use restricted Bash commands for running standard Rails generators, such as
bin/rails generate channelandbin/rails solid_cable:install. These commands are used for boilerplate code generation and initial configuration within the development environment. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading and analyzing project files like
Gemfileandconfig/cable.yml. This creates a surface where the agent processes local codebase content. The ingestion points include configuration files and channel directories, and while no specific boundary markers or agent-level sanitization are defined for the reading process, the skill focuses on technical implementation and promotes secure coding practices without incorporating untrusted external data sources. - [SAFE]: The instructions explicitly guide the user to implement critical security measures, including connection authentication using
reject_unauthorized_connection, production origin filtering viaallowed_request_origins, and server-side validation of channel parameters.
Audit Metadata