Skills skill-rails-upgrade
📦
skill-rails-upgrade
Content revision r1 Safe ⚙️ External commands🌐 Network access📁 Filesystem access
Assess Rails Upgrades Safely
Rails upgrades can hide breaking changes, dependency drift, and risky file overwrites. This skill builds a structured upgrade assessment and selective merge plan before changes are applied.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "skill-rails-upgrade" from https://skillstore.io/skills/sickn33-skill-rails-upgrade.md and its manifest at https://skillstore.io/api/skills/sickn33-skill-rails-upgrade/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "skill-rails-upgrade". A maintainer asks for an upgrade check from Rails 7.1 to Rails 8.0.
Expected outcome:
- Current Rails version: 7.1.x. Target release: 8.0.x.
- Complexity: Large because the upgrade crosses a major version.
- Next actions: review deprecations, compare default files, update dependencies on a clean branch, and run tests.
Using "skill-rails-upgrade". A project has a customized application configuration file and a changed bin script.
Expected outcome:
- Manual merge needed for application configuration because local settings must be preserved.
- Manual merge needed for the bin script because the project uses custom process management.
- Safe updates can proceed only for files that match Rails defaults.
Using "skill-rails-upgrade". A Rails app uses importmap and Hotwire packages.
Expected outcome:
- Package manager: importmap with Rails-related pins.
- Review Turbo and Stimulus pins against the target Rails release.
- Apply pin updates only after confirming the framework upgrade path.
Security Audit
Safev6 • 7/9/2026 Open versioned report
Most static backtick findings are Markdown formatting false positives, including filenames, URLs, package names, and code fences. Several real command examples can modify dependencies, files, credentials, or database state, so they should require explicit user approval. No evidence of prompt injection, credential exfiltration, or malicious intent was found in SKILL.md.
1
Files scanned
409
Lines analyzed
14
Review items
0
False positives ignored
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
```bash
The surrounding bash block asks the agent to run gh api against GitHub. This is legitimate version discovery, but it still executes a local CLI and performs a network request with the user authentication context.
Medium
Ruby/shell backtick execution
```bash
The surrounding bash block asks the agent to run gh api against GitHub tags. This is legitimate release discovery, but it is still external command execution with network access.
Medium
Ruby/shell backtick execution
```bash
The surrounding bash block runs npm outdated and npm view commands. These commands contact the npm registry and inspect dependency metadata, so they require normal external-command safeguards.
Medium
Ruby/shell backtick execution
```bash
The importmap pin commands can update project importmap configuration and may fetch package metadata. They are legitimate only after the user agrees to dependency changes.
Medium
Ruby/shell backtick execution
- Run `npm update @hotwired/turbo-rails` (or yarn equivalent)
The npm update command modifies dependencies and lock files while fetching packages. This can change the application supply chain, so user confirmation is required.
Medium
Ruby/shell backtick execution
- Run `npm update @rails/actioncable @rails/activestorage` to match Rails version
The npm update command modifies Rails-related JavaScript dependencies and lock files. This is expected upgrade work, but it is a real supply-chain change.
Medium
Ruby/shell backtick execution
4. Run `bundle update rails`
The bundle update rails command changes Ruby dependency resolution and may update Gemfile.lock. This is project-mutating dependency work and needs explicit user approval.
Medium
Ruby/shell backtick execution
```bash
The rails new command creates files under /tmp and runs the local Rails generator. It is legitimate template extraction, but it has filesystem side effects.
Medium
Ruby/shell backtick execution
```bash
The app:update:configs command can change Rails configuration files. The skill notes it is interactive, but it still performs project-mutating generator work.
Medium
Ruby/shell backtick execution
```bash
The db:migrate command can alter database schema or data state. This is normal Rails upgrade work, but it is a material side effect.
Medium
Ruby/shell backtick execution
```bash
Starting bin/dev executes the local Rails application and may run project initializers. This is a standard verification step, but it still executes project code.
Medium
Ruby/shell backtick execution
```bash
Opening bin/rails console loads the application environment and project code. It is a normal diagnostic command, but execution should be intentional.
Medium
Ruby/shell backtick execution
```bash
Running bin/rails test executes project test code. This is expected verification, but it remains external command execution in the user workspace.
Medium
Ruby/shell backtick execution
- If `gh` CLI is not authenticated, instruct the user to run `gh auth login`
The gh auth login instruction can create or change local GitHub CLI credential state. It is legitimate troubleshooting, but the user should initiate it knowingly.
Risk Factors
⚙️ External commands (70)
SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:29 SKILL.md:30 SKILL.md:32 SKILL.md:38-40 SKILL.md:40-42 SKILL.md:42-46 SKILL.md:46-48 SKILL.md:48-62 SKILL.md:62-77 SKILL.md:77-79 SKILL.md:79-98 SKILL.md:98-104 SKILL.md:104-108 SKILL.md:108-110 SKILL.md:110-113 SKILL.md:113-119 SKILL.md:119-120 SKILL.md:120-121 SKILL.md:121-122 SKILL.md:122-123 SKILL.md:123-124 SKILL.md:124-130 SKILL.md:130-137 SKILL.md:137-141 SKILL.md:141-143 SKILL.md:143-145 SKILL.md:145-148 SKILL.md:148-151 SKILL.md:151-157 SKILL.md:157-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171-210 SKILL.md:210-212 SKILL.md:212-231 SKILL.md:231-233 SKILL.md:233-239 SKILL.md:239-246 SKILL.md:246-259 SKILL.md:259-260 SKILL.md:260-261 SKILL.md:261 SKILL.md:268-295 SKILL.md:295-304 SKILL.md:304-308 SKILL.md:308-311 SKILL.md:311-313 SKILL.md:313-328 SKILL.md:328-329 SKILL.md:329-337 SKILL.md:337-343 SKILL.md:343-345 SKILL.md:345-348 SKILL.md:348-350 SKILL.md:350-357 SKILL.md:357-359 SKILL.md:359-362 SKILL.md:362-364 SKILL.md:364-367 SKILL.md:367-369 SKILL.md:369-379 SKILL.md:379-381 SKILL.md:381-382 SKILL.md:382-384 SKILL.md:384-385 SKILL.md:385-397 SKILL.md:397
🌐 Network access (7)
📁 Filesystem access (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-skill-rails-upgrade?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-skill-rails-upgrade?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-skill-rails-upgrade/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-skill-rails-upgrade.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). skill-rails-upgrade security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6BibTeX citation
@techreport{sickn33-sickn33-skill-rails-upgrade-2026,
author = {sickn33},
title = {skill-rails-upgrade security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-rails-upgrade security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6"
identifiers:
- type: other
value: "skillstore:sickn33-skill-rails-upgrade:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Plan a Major Rails Upgrade
Map version changes, likely breaking changes, and configuration updates before moving to a new Rails major version.
Estimate Client Upgrade Scope
Produce a concise assessment of dependency work, file merge risk, and test expectations for a Rails upgrade proposal.
Review Sprint Readiness
Identify upgrade blockers, local customizations, and verification steps before committing team time to framework maintenance.
Try These Prompts
Assess Current Version
Analyze this Rails app. Tell me the current Rails version, latest stable version, upgrade type, and first risks to review.
Plan a Target Upgrade
Assess the upgrade from my current Rails version to the target version I provide. Include guide changes, railsdiff changes, and JavaScript dependencies.
Build a Merge Plan
Compare my local config, bin, and public files with Rails default changes. Separate new files, safe updates, manual merges, and skipped changes.
Execute Approved Steps
After I approve the upgrade plan, apply only the agreed changes. Then run migrations, run tests, and summarize failures and follow-up work.
Best Practices
- Start from a clean branch with the current test suite passing.
- Review deprecation warnings before changing the Rails version.
- Confirm every generated file update before overwriting local customizations.
Avoid
- Running a full Rails app update without checking local changes first.
- Treating JavaScript and importmap dependencies as unrelated to the Rails upgrade.
- Starting a major upgrade without a rollback plan and test baseline.
Frequently Asked Questions
Does this skill upgrade the app automatically?
It focuses on assessment and planning first. It should apply changes only after the user approves a specific plan.
Can it handle major Rails upgrades?
Yes. It classifies major upgrades as higher complexity and highlights breaking changes, dependency work, and manual merge needs.
Does it check JavaScript dependencies?
Yes. It checks common Hotwire and Rails JavaScript packages for npm, yarn, and importmap-based applications.
What happens if railsdiff lacks an exact comparison?
The skill should try nearby major and minor version comparisons, then clearly state the limitation.
Is a passing test suite still required?
Yes. The assessment can guide the work, but tests are required to validate compatibility.
Will it preserve local configuration changes?
It is designed to detect local customizations and separate them into manual merge items before changes are made.