技能 skill-rails-upgrade
📦

skill-rails-upgrade

内容修订 r1 安全 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

安全评估 Rails 升级

Rails 升级可能隐藏破坏性变更、依赖漂移和高风险文件覆盖。此 skill 会在应用变更之前，构建结构化的升级评估和选择性合并计划。

支持: Claude Codex Code(CC)
🥉 77 青铜

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "skill-rails-upgrade" from https://skillstore.io/skills/sickn33-skill-rails-upgrade.md and its manifest at https://skillstore.io/api/skills/sickn33-skill-rails-upgrade/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/sickn33-skill-rails-upgrade.md 已签名 manifest GET /api/skills/sickn33-skill-rails-upgrade/manifest 已签名 lockfile GET /api/skills/sickn33-skill-rails-upgrade/lockfile

测试它

正在使用“skill-rails-upgrade”。 维护者请求检查从 Rails 7.1 升级到 Rails 8.0。

预期结果:

  • 当前 Rails 版本：7.1.x。目标版本：8.0.x。
  • 复杂度：高，因为此次升级跨越了一个主版本。
  • 后续操作：审查弃用项，比较默认文件，在干净分支上更新依赖，并运行测试。

正在使用“skill-rails-upgrade”。 某项目有自定义的应用程序配置文件和已修改的 bin 脚本。

预期结果:

  • 应用程序配置需要手动合并，因为必须保留本地设置。
  • bin 脚本需要手动合并，因为该项目使用自定义进程管理。
  • 只有与 Rails 默认内容匹配的文件才能进行安全更新。

正在使用“skill-rails-upgrade”。 一个 Rails app 使用 importmap 和 Hotwire 包。

预期结果:

  • 包管理器：importmap，带有 Rails 相关 pins。
  • 根据目标 Rails 版本审查 Turbo 和 Stimulus pins。
  • 仅在确认框架升级路径之后应用 pin 更新。

安全审计

安全
v6 • 2026/7/9 打开版本化报告

Most static backtick findings are Markdown formatting false positives, including filenames, URLs, package names, and code fences. Several real command examples can modify dependencies, files, credentials, or database state, so they should require explicit user approval. No evidence of prompt injection, credential exfiltration, or malicious intent was found in SKILL.md.

1
已扫描文件
409
分析行数
14
复核项
0
已忽略误报
能力复核项 (14)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
SKILL.md:38-40
Ruby/shell backtick execution
```bash
The surrounding bash block asks the agent to run gh api against GitHub. This is legitimate version discovery, but it still executes a local CLI and performs a network request with the user authentication context.
中
SKILL.md:46-48
Ruby/shell backtick execution
```bash
The surrounding bash block asks the agent to run gh api against GitHub tags. This is legitimate release discovery, but it is still external command execution with network access.
中
SKILL.md:130-137
Ruby/shell backtick execution
```bash
The surrounding bash block runs npm outdated and npm view commands. These commands contact the npm registry and inspect dependency metadata, so they require normal external-command safeguards.
中
SKILL.md:148-151
Ruby/shell backtick execution
```bash
The importmap pin commands can update project importmap configuration and may fetch package metadata. They are legitimate only after the user agrees to dependency changes.
中
SKILL.md:169-170
Ruby/shell backtick execution
- Run `npm update @hotwired/turbo-rails` (or yarn equivalent)
The npm update command modifies dependencies and lock files while fetching packages. This can change the application supply chain, so user confirmation is required.
中
SKILL.md:170-171
Ruby/shell backtick execution
- Run `npm update @rails/actioncable @rails/activestorage` to match Rails version
The npm update command modifies Rails-related JavaScript dependencies and lock files. This is expected upgrade work, but it is a real supply-chain change.
中
SKILL.md:210-212
Ruby/shell backtick execution
4. Run `bundle update rails`
The bundle update rails command changes Ruby dependency resolution and may update Gemfile.lock. This is project-mutating dependency work and needs explicit user approval.
中
SKILL.md:304-308
Ruby/shell backtick execution
```bash
The rails new command creates files under /tmp and runs the local Rails generator. It is legitimate template extraction, but it has filesystem side effects.
中
SKILL.md:311-313
Ruby/shell backtick execution
```bash
The app:update:configs command can change Rails configuration files. The skill notes it is interactive, but it still performs project-mutating generator work.
中
SKILL.md:343-345
Ruby/shell backtick execution
```bash
The db:migrate command can alter database schema or data state. This is normal Rails upgrade work, but it is a material side effect.
中
SKILL.md:357-359
Ruby/shell backtick execution
```bash
Starting bin/dev executes the local Rails application and may run project initializers. This is a standard verification step, but it still executes project code.
中
SKILL.md:362-364
Ruby/shell backtick execution
```bash
Opening bin/rails console loads the application environment and project code. It is a normal diagnostic command, but execution should be intentional.
中
SKILL.md:367-369
Ruby/shell backtick execution
```bash
Running bin/rails test executes project test code. This is expected verification, but it remains external command execution in the user workspace.
中
SKILL.md:397
Ruby/shell backtick execution
- If `gh` CLI is not authenticated, instruct the user to run `gh auth login`
The gh auth login instruction can create or change local GitHub CLI credential state. It is legitimate troubleshooting, but the user should initiate it knowingly.

风险因素

⚙️ 外部命令 (70)
SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:29 SKILL.md:30 SKILL.md:32 SKILL.md:38-40 SKILL.md:40-42 SKILL.md:42-46 SKILL.md:46-48 SKILL.md:48-62 SKILL.md:62-77 SKILL.md:77-79 SKILL.md:79-98 SKILL.md:98-104 SKILL.md:104-108 SKILL.md:108-110 SKILL.md:110-113 SKILL.md:113-119 SKILL.md:119-120 SKILL.md:120-121 SKILL.md:121-122 SKILL.md:122-123 SKILL.md:123-124 SKILL.md:124-130 SKILL.md:130-137 SKILL.md:137-141 SKILL.md:141-143 SKILL.md:143-145 SKILL.md:145-148 SKILL.md:148-151 SKILL.md:151-157 SKILL.md:157-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171-210 SKILL.md:210-212 SKILL.md:212-231 SKILL.md:231-233 SKILL.md:233-239 SKILL.md:239-246 SKILL.md:246-259 SKILL.md:259-260 SKILL.md:260-261 SKILL.md:261 SKILL.md:268-295 SKILL.md:295-304 SKILL.md:304-308 SKILL.md:308-311 SKILL.md:311-313 SKILL.md:313-328 SKILL.md:328-329 SKILL.md:329-337 SKILL.md:337-343 SKILL.md:343-345 SKILL.md:345-348 SKILL.md:348-350 SKILL.md:350-357 SKILL.md:357-359 SKILL.md:359-362 SKILL.md:362-364 SKILL.md:364-367 SKILL.md:367-369 SKILL.md:369-379 SKILL.md:379-381 SKILL.md:381-382 SKILL.md:382-384 SKILL.md:384-385 SKILL.md:385-397 SKILL.md:397
🌐 网络访问 (7)
SKILL.md:4 SKILL.md:62 SKILL.md:77 SKILL.md:79 SKILL.md:219 SKILL.md:220 SKILL.md:221
📁 文件系统访问 (5)
SKILL.md:100 SKILL.md:103 SKILL.md:132 SKILL.md:135 SKILL.md:136
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-skill-rails-upgrade/security.svg)](https://skillstore.io/skills/sickn33-skill-rails-upgrade?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/sickn33-skill-rails-upgrade?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-skill-rails-upgrade/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/sickn33-skill-rails-upgrade.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

sickn33. (2026). skill-rails-upgrade security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6

BibTeX 引用

@techreport{sickn33-sickn33-skill-rails-upgrade-2026, author = {sickn33}, title = {skill-rails-upgrade security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "skill-rails-upgrade security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-09" url: "https://skillstore.io/skills/sickn33-skill-rails-upgrade/audits/6" identifiers: - type: other value: "skillstore:sickn33-skill-rails-upgrade:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 高
55
架构
85
可维护性
87
内容
70
社区
83
规范符合性

你能构建什么

规划一次 Rails 主版本升级

在迁移到新的 Rails 主版本之前，梳理版本变化、可能的破坏性变更和配置更新。

估算客户升级范围

为 Rails 升级提案生成一份简明评估，涵盖依赖工作、文件合并风险和测试预期。

审查 Sprint 准备情况

在投入团队时间进行框架维护之前，识别升级阻碍、本地自定义内容和验证步骤。

试试这些提示

评估当前版本 
分析这个 Rails app。告诉我当前 Rails 版本、最新稳定版本、升级类型，以及首先要审查的风险。
规划目标升级 
评估从我当前 Rails 版本升级到我提供的目标版本。包括指南变更、railsdiff 变更和 JavaScript 依赖。
构建合并计划 
将我的本地 config、bin 和 public 文件与 Rails 默认变更进行比较。区分新文件、安全更新、手动合并和跳过的变更。
执行已批准步骤 
在我批准升级计划之后，只应用已约定的变更。然后运行迁移、运行测试，并总结失败项和后续工作。

最佳实践

  • 从一个干净分支开始，并确保当前测试套件通过。
  • 在更改 Rails 版本之前审查弃用警告。
  • 在覆盖本地自定义内容之前，确认每一个生成的文件更新。

避免

  • 在未先检查本地变更的情况下运行完整 Rails app update。
  • 将 JavaScript 和 importmap 依赖视为与 Rails 升级无关。
  • 在没有回滚计划和测试基线的情况下开始主版本升级。

常见问题

这个 skill 会自动升级应用吗？
它首先专注于评估和规划。只有在用户批准具体计划之后，才应应用变更。
它能处理 Rails 主版本升级吗？
可以。它会将主版本升级归类为更高复杂度，并突出破坏性变更、依赖工作和手动合并需求。
它会检查 JavaScript 依赖吗？
会。它会检查 npm、yarn 和基于 importmap 的应用中常见的 Hotwire 和 Rails JavaScript 包。
如果 railsdiff 缺少精确比较会怎样？
该 skill 应尝试使用相邻的主版本和次版本比较，然后清楚说明这一限制。
仍然需要通过测试套件吗？
仍然需要。评估可以指导工作，但必须通过测试来验证兼容性。
它会保留本地配置变更吗？
它旨在检测本地自定义内容，并在进行变更之前将其分离为手动合并项。

开发者详情

作者

sickn33

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/sickn33/antigravity-awesome-skills/tree/main/web-app/public/skills/skill-rails-upgrade

引用

26421118b848d9f1efc0aa169d8a7a9e7e0a877e

维护新鲜度

2026/7/25

使用量

7 次下载 · 197 次浏览

文件结构

📄 SKILL.md

sickn33 的更多技能

查看全部

相关技能

查看全部