Individual skill
code-review-ruby
Security review of Ruby code — dangerous sinks and Rails pitfalls. Load when reviewing a Ruby/Rails codebase/PR, on .rb source in scope, or "review this Rails app". Signals: Gemfile, config/routes.rb, ActiveRecord, ERB, YAML.load, send/constantize.
skills/code-review/code-review-ruby/SKILL.md
Source commit ee0e0c50d2f6d941a14b73dd85a2b470d0ab976e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 27
- Repository last updated
- Oct 14, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- ai-security Repository topic
- application-security Repository topic
- blue-team Repository topic
- bug-bounty Repository topic
- claude-code Repository topic
- codex Repository topic
- detection-engineering Repository topic
- gemini Repository topic
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Read excerpt
# Ruby / Rails source review
## When it applies
Reviewing Ruby source, usually Rails. Rails is safe by default in many places, so the bugs cluster
in dynamic dispatch, mass assignment gaps, raw SQL, and unsafe deserialization/rendering.
## Why it works
Ruby's metaprogramming (`send`, `constantize`, `eval`) turns strings into method/class/code
references, and Rails helpers have unsafe escape hatches (`.html_safe`, `where("...#{x}...")`,
`render inline:`). Tracing params to these is the whole game — and Brakeman automates the first pass.
## Sinks & patterns (grep, then trace to user input)
- **Code exec**: `eval`, `instance_eval`, `class_eval`, backticks/`system`/`%x`/`exec`/`open("|…")`.
- **Dynamic dispatch**: `send`/`public_send`/`__send__` with a param method name; `constantize`/