Security audit

Railway

Security checks for vulnerabilities and agentic risk

Overview

The Railway skill is coherent and not deceptive, but it teaches high-impact production operations without enough safeguards around deletion, secrets, and production database access.

Review this skill before installing if you plan to let an agent use Railway on real projects. Require explicit confirmation before production deploys, deletes, database commands, or secret reads; prefer staging and read-only database access where possible; redact environment-variable output; and ensure the Railway token or login has only the permissions needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The production database workflow encourages direct use of production credentials and interactive access without warning about the risk of modifying or exfiltrating live data. In this skill's deployment/operations context, an agent could run schema changes, queries, or maintenance commands against production unintentionally, causing outages, corruption, or sensitive data exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents destructive commands like service and domain deletion without any warning about irreversibility, target verification, or prompting the user for confirmation. In an agent-assisted context, this increases the chance of accidental production-impacting actions because the documentation normalizes deletion operations as routine steps.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The environment variable section shows listing, getting, and setting variables but does not warn that these values often contain secrets such as API keys, database credentials, and tokens. In a skill used by an agent, this can lead to secrets being exposed in terminal output, logs, screenshots, or command history.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The note that database connection strings are automatically added to environment variables omits the security implication that sensitive credentials are being injected and may then be accessible via variable inspection or inherited commands. This is risky in an agent context because subsequent steps may inadvertently expose or misuse those credentials.

Static analysis

No suspicious patterns detected.