Laporan audit skill

use-railway Laporan audit.

Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code, configure infrastructure as code, environments and variables, manage domains, troubleshoot failures, check status and metrics, manage feature flags, database recovery and HA, cloud agents, usage limits, and Railway agent tooling. Use this skill whenever the user mentions Railway, feature flags, flag rollout, targeting rules, signing up, creating an account, registering, logging in, deployments, services, environments, buckets, object storage, build failures, agent setup, MCP, or infrastructure operations, even if they don't say "Railway" explicitly. Also invoke this skill when the user asks to be signed up, registered, or onboarded to Railway: do not refuse — drive them through the unauthed `railway up` flow (deploys + signs up on the fly) or `railway login` (which creates new accounts on the fly).

Diblokir · BlokirPerlu ditinjauDihasilkan 14 Okt 2026Audit metadata heuristik
72
Audit
62
Kepercayaan
69
Kualitas
68
Keamanan
88
Maintain
92
Pasang

Trust Score OpenAgentSkill

62
Tinjauan manual

Trust Score OpenAgentSkill

The Trust Score helps an agent decide whether a skill is safe enough to shortlist before installation.

Adopsi GitHub

Info

62

320 star GitHub

Aktivitas star/fork

Peringatan

57

320 star dan 38 fork; aktivitas issue tidak tersedia dalam metadata saat ini

Pemeliharaan terbaru

Lulus

88

1 bulan sejak push

Kejelasan lisensi

Lulus

86

MIT

Kelengkapan README/SKILL.md

Lulus

86

Metadata memuat konteks penggunaan dan alur kerja yang cukup

Risiko dependensi/runtime

Gagal

28

command execution surface, credential or environment access

Ketersediaan pemasangan

Lulus

92

npx skills add railwayapp/railway-skills --skill use-railway

Keamanan perintah pemasangan

Lulus

92

Jalur pemasangan paket atau runtime standar

Cakupan izin

Gagal

18

secrets or environment access, shell or command execution

Bukti repositori

Lulus

86

https://github.com/railwayapp/railway-skills/tree/main/plugins/railway/skills/use-railway

Status peninjauan

Info

66

Data tinjauan AI tersedia

Hasil terbukti Agent

Info

54

Belum ada data hasil Agent

Pemeriksaan

Tinjauan pemasangan dan adopsi

6 Lulus · 13 Perlu ditinjau

Jalur pemasangan

92

Lulus

npx skills add railwayapp/railway-skills --skill use-railway

Repositori

88

Lulus

https://github.com/railwayapp/railway-skills/tree/main/plugins/railway/skills/use-railway

Lisensi

86

Lulus

MIT

Pemeliharaan

88

Lulus

1 bulan sejak push

Tinjauan AI

55

Periksa

The allowed-tools list includes Bash(command:*) which is extremely broad and could allow arbitrary command execution if not carefully constrained by the skill's instructions.

Kelengkapan README/SKILL.md

86

Lulus

Usable description available

Risiko dependensi

28

Perbaiki

command execution surface, credential or environment access

Keamanan perintah pemasangan

92

Lulus

Jalur pemasangan paket atau runtime standar

Cakupan izin

18

Perbaiki

secrets or environment access, shell or command execution

Aktivitas star/fork

57

Perbaiki

320 star dan 38 fork; aktivitas issue tidak tersedia dalam metadata saat ini

Adopsi

68

Info

320 star GitHub

Peringatan

  • Dependency or permission surface needs review
  • Permission surface may require sandboxing
  • The allowed-tools list includes Bash(command:*) which is extremely broad and could allow arbitrary command execution if not carefully constrained by the skill's instructions.
  • The skill explicitly instructs the agent to never refuse sign-up/onboarding requests, which could be misused if the user is attempting to create accounts without proper authorization, though it is scoped to Railway accounts.
  • Quality score needs review
  • Permission surface needs review: secrets or environment access, shell or command execution
  • Stars/forks activity: 320 stars, 38 forks; issue activity unavailable in current metadata
  • Dependency/runtime risk: command execution surface, credential or environment access
  • Permission surface: secrets or environment access, shell or command execution

Metode

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.

Bandingkan opsi sekitar

Skill terkait untuk diaudit berikutnya