turborepo
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill provides standard documentation and best practices for Turborepo, including correct secret management and tool usage. All external resources point to trusted services and official documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with project configuration files (
turbo.json,package.json), creating an attack surface where a malicious repository could attempt to influence the agent's behavior. - Ingestion points: The skill triggers on and instructs the agent to read
turbo.json,package.json, and the monorepo directory structure. - Boundary markers: No explicit boundary markers or warnings are defined for processing these specific configuration files.
- Capability inventory: The skill enables the agent to execute build, test, and lint tasks using the
turboCLI and other ecosystem tools. - Sanitization: Content from the configuration files is used to define task pipelines without explicit sanitization steps mentioned.
Audit Metadata