Security audit

Railway Deploy

Security checks for vulnerabilities and agentic risk

Overview

This Railway deployment skill is not malware, but it can guide broad Railway infrastructure changes, including deletions, from generic deployment requests.

Review before installing. Use this only if you are comfortable with an agent using your Railway CLI authentication to deploy and potentially modify Railway resources. Require explicit confirmation of the target project, environment, and service before any command, and do not allow service, volume, or variable deletion unless you intentionally requested an admin change and have backups or rollback plans.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/railpack.md:198
Finding: Unpinned npm Scaffolding Packages Permit Mutable Third-Party Code Execution
Content: View full analysis
Remediation: View remediation
. -- --template react npm create astro@ ``` 2. Periodically review and deliberately update pinned versions rather than resolving mutable releases at execution time. 3. Require explicit user confirmation before downloading or executing any scaffolding package. 4. Keep scaffolding outside the deployment Skill because it is not necessary for `railway up`. 5. Preserve and enforce the `Bash(railway:*)` allowlist so the Skill cannot directly execute npm. 6. Run unavoidable generators in a restricted environment without production secrets, deployment tokens, SSH credentials, or write access outside the intended project directory. 7. Review generated files and dependency manifests before installation or deployment. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The service deletion example provides a ready-to-use destructive command with no warning, confirmation, or indication of blast radius. In the context of a deploy skill, this is especially dangerous because a user asking to 'deploy' or 'push' would not reasonably expect the skill to have deletion pathways available.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The volume deletion example can lead to irreversible data loss, yet it is presented without any safety language or confirmation guidance. Since volumes commonly store persistent application data, exposing this operation in a deploy-oriented reference sharply increases the risk of catastrophic accidental destruction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata description includes very broad trigger phrases such as 'deploy', 'ship', and 'push', which can match common user language outside the narrow intent of deploying code to Railway. This creates a meaningful risk of unintended invocation, leading the agent to run deployment-related actions when the user may have meant something else, especially because deployment is an externally impactful operation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The 'When to Use' section repeats ambiguous activation cues like 'deploy', 'ship', 'push code', and especially 'deploy and fix any issues', which could authorize both deployment and iterative troubleshooting without strong scope checks. In the context of a deployment skill with shell access to Railway commands, ambiguous routing increases the chance of unintended production-affecting actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The reference materially expands the deploy skill from 'push code to Railway' into broad environment administration, including variables, shared variables, volumes, buckets, lifecycle flags, and deletion operations. In an agent setting, this scope creep can cause the skill to perform powerful configuration changes a user did not intend when invoking a simple deploy action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The generic instruction to apply arbitrary JSON patches via railway environment edit --json enables sweeping environment changes without any warning, confirmation, or mention of least-privilege handling. In an LLM-agent workflow, that makes it easier for ambiguous or prompt-injected requests to become direct state-changing operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation states variables can be deleted by setting them to null but gives no warning that this can immediately break deployments, revoke connectivity, or remove secrets required by running services. Because environment variables often hold credentials and critical runtime configuration, silent deletion is operationally dangerous.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file explicitly documents 'New Service Instance' creation even though the skill metadata says initial setup or creating services should use the new skill. This contradiction increases the chance an agent using this reference will create infrastructure under the deploy skill, bypassing intended skill boundaries and user expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The sample HTML sets lang="en", which is a natural-language locale choice presented as the default scaffolding. The file does not offer an alternative locale or explain that English is only an example, so it can be read as forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.