The Agent Skills Directory

[Data Exposure & Exfiltration] (CRITICAL): The helper script scripts/railway-api.sh reads the sensitive configuration file ~/.railway/config.json to retrieve the user's authentication token. This token is subsequently transmitted via curl to backboard.railway.com. Since this domain is not included in the trusted whitelist, the behavior is classified as active exfiltration of credentials.
[Indirect Prompt Injection] (HIGH): The skill is highly susceptible to indirect prompt injection because it ingests data from external API responses (railway list, whoami, status) and processes it without sanitization or boundary markers.
Ingestion points: API JSON data processed in SKILL.md and scripts/railway-api.sh.
Boundary markers: None present in the skill instructions or reference documents.
Capability inventory: Extensive project modification capabilities, including the ability to link projects, change project visibility (isPublic), and modify environment configurations.
Sanitization: No validation or escaping of the data extracted from API responses is performed before it is used to influence agent decisions or subsequent commands.
[Command Execution] (HIGH): Through the manipulation of buildCommand and startCommand within the EnvironmentConfig (as detailed in references/environment-config.md), the skill allows for the execution of arbitrary commands on the Railway infrastructure. This high-privilege capability is a critical risk factor when combined with the lack of sanitization of external data.

projects