ruby-on-rails-skill-docs
The skill is highly insecure, featuring mass assignment vulnerabilities, JWT forgery risks, unconstrained tool execution, and susceptibility to prompt injection attacks via external file references.
Skill Info
Install
npx skills add https://github.com/LeviReisJs/ruby-on-rails-skill-docsAssessments (3)
AI Agent Traps ↗DeBERTa classifier detected prompt injection (confidence: 0.99)
The skill instructs the agent to read external reference files (e.g., references/security.md). If these files are dynamically generated or fetched from an external source, they could contain malicious instructions that the agent is primed to follow.
Para tarefas específicas, leia o arquivo de referência correspondente
User-supplied parameters are passed to an ActiveRecord create or update method without proper whitelisting. An attacker can set any model attribute including admin flags or role fields. Use strong parameters with explicit permit() calls listing only allowed fields. (seen 2 times in this file at lines 8, 21)
User.new(user_create_params)
JWT decoded with signature verification disabled or with `alg:none` allowed. This permits token forgery. Always pass `true` for verification and restrict algorithms to expected values like `algorithms: ["HS256"]`.
JWT.decode(token, public_key, false)
NER model detected organization in skill content (confidence: 0.51)
N***
NER model detected organization in skill content (confidence: 0.55)
M**********
NER model detected organization in skill content (confidence: 0.56)
O*
NER model detected organization in skill content (confidence: 0.59)
A**
NER model detected organization in skill content (confidence: 0.65)
A*********
NER model detected organization in skill content (confidence: 0.68)
I***
NER model detected organization in skill content (confidence: 0.69)
N**
NER model detected organization in skill content (confidence: 0.77)
S**
NER model detected organization in skill content (confidence: 0.78)
C****************************
NER model detected organization in skill content (confidence: 0.88)
M*******
NER model detected organization in skill content (confidence: 0.90)
S******
NER model detected organization in skill content (confidence: 0.91)
A********
NER model detected organization in skill content (confidence: 0.93)
D*****
NER model detected organization in skill content (confidence: 0.94)
R************
NER model detected organization in skill content (confidence: 0.97)
R***
NER model detected organization in skill content (confidence: 0.98)
R****
NER model detected organization in skill content (confidence: 0.99)
A***********
NER model detected organization in skill content (confidence: 0.63)
*
Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.
Skill contains network access patterns (HTTP requests, socket connections) without declaring network capability in allowed-tools.
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Skill description is empty or too short. A clear description helps users evaluate the skill's purpose.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/LeviReisJs/ruby-on-rails-skill-docs)<a href="https://mondoo.com/ai-agent-security/skills/github/LeviReisJs/ruby-on-rails-skill-docs"><img src="https://mondoo.com/ai-agent-security/api/badge/github/LeviReisJs/ruby-on-rails-skill-docs.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/LeviReisJs/ruby-on-rails-skill-docs.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow