Railway

Railway deployment platform — projects, services, deployments, variables. App hosting CLI.

Security Scan

The skill mostly does what it says (a Railway CLI) and only needs a Railway API token, but the bundled script quietly falls back to reading a .env file from a workspace path (or WORKSPACE) that the SKILL.md does not declare—this mismatch and implicit file access is worth caution.

Purpose & Capability

Name/description, declared env var (RAILWAY_API_TOKEN), and the included CLI implementation all align with a Railway platform client. The GraphQL endpoint used (backboard.railway.app/graphql/v2) matches the stated purpose.

Instruction Scope

SKILL.md instructs running the included Python script with RAILWAY_API_TOKEN set. The runtime script behaves as described, but it also attempts a fallback: reading a .env file from a workspace path (WORKSPACE or default ~/.openclaw/workspace/.env). That file-read behavior is not documented in SKILL.md and expands the instruction scope beyond what the metadata declares.

Install Mechanism

No install spec; this is instruction-only plus a single Python script that uses only the stdlib. There is no download-from-URL or package installation that would write/execute arbitrary third-party code.

Credentials

The skill only requires RAILWAY_API_TOKEN (primary credential), which is proportionate. However, the script will also read WORKSPACE (an environment variable) to locate a .env file and parse RAILWAY_API_TOKEN from it if the env var is not set—this implicit file access and use of WORKSPACE is not declared under 'required config paths' and could cause unexpected credential reads.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default) but not combined with other high-risk factors.

What to consider before installing

This skill appears to be a straightforward Railway CLI and asks only for a RAILWAY_API_TOKEN. Before installing, consider: 1) Review the included scripts (you already have them) — the script will try to read a .env file at WORKSPACE/.env or ~/.openclaw/workspace/.env as a fallback for the token; make sure that file does not contain other secrets you don't want the skill to read. 2) Provide a dedicated Railway token with minimal needed scope rather than a full-privilege account. 3) If you want to avoid any implicit file reads, set RAILWAY_API_TOKEN explicitly in the environment when invoking, or edit the script to remove the .env fallback. 4) Confirm the author/homepage links and repository trustworthiness if you plan to use this in production. These precautions will reduce accidental exposure of other credentials.

App deployment — projects, services, deployments, and variables.

Features

• Projects — create, list, get
• Services — list project services
• Deployments — view deployment status
• Variables — manage env vars

Requirements

Variable	Required	Description
RAILWAY_API_TOKEN	✅	API key/token for Railway

Quick Start

python3 {baseDir}/scripts/railway.py projects
python3 {baseDir}/scripts/railway.py project <id>
python3 {baseDir}/scripts/railway.py services <project-id>
python3 {baseDir}/scripts/railway.py me

Credits

Built by M. Abidi | agxntsix.ai YouTube | GitHub Part of the AgxntSix Skill Suite for OpenClaw agents.

📅 Need help setting up OpenClaw for your business? Book a free consultation