The Agent Skills Directory

[CREDENTIALS_UNSAFE] (HIGH): The file scripts/railway-api.sh programmatically accesses ~/.railway/config.json to extract the Railway user authentication token. Accessing local CLI configuration files for long-lived credentials is a high-risk behavior.
[DATA_EXFILTRATION] (HIGH): The script scripts/railway-api.sh transmits the extracted local authentication token to https://backboard.railway.com/graphql/v2. As this domain is not within the trusted whitelist and the action involves sending local secrets to an external endpoint, it is classified as a data exfiltration risk.
[PROMPT_INJECTION] (HIGH): The skill exhibits a significant surface for indirect prompt injection (Category 8) due to its interaction with untrusted external data.
Ingestion points: Data enters the agent context via railway status --json and the output of GraphQL queries in scripts/railway-api.sh (e.g., template and environmentConfig queries).
Boundary markers: Absent. There are no delimiters or instructions to ignore embedded content within the API responses.
Capability inventory: The skill has high-privilege capabilities including infrastructure deployment (deployTemplateV2), environment configuration modification (railway environment edit), and arbitrary bash execution.
Sanitization: Absent. The skill lacks validation or sanitization of the JSON payloads retrieved from the API before they are used to influence logic or command arguments.
[COMMAND_EXECUTION] (MEDIUM): The skill relies on complex shell script execution via bash heredocs (bash <<'SCRIPT'). While the use of single quotes mitigates some local shell expansion risks, the pattern allows for the execution of multi-step side effects that modify the user's cloud environment.

database