turborepo-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on providing structural and organizational rules for monorepos using Turborepo and Bun/pnpm. It includes security-conscious instructions, such as forbidding library packages from reading
process.envdirectly and requiring apps to pass configuration through factories, which helps prevent accidental credential exposure. - [INDIRECT_PROMPT_INJECTION]: The skill performs analysis of existing codebase files (like
package.jsonandturbo.jsonc) to provide architectural reviews and scaffolding recommendations. This involves processing untrusted data from the repository environment. While the instructions do not explicitly define boundary markers or sanitization for these inputs, this is a standard operational requirement for its primary purpose and does not introduce risks beyond the baseline for repository management tools. - [COMMAND_EXECUTION]: The documentation includes standard development command examples (e.g.,
bun run typecheck,turbo run dev,docker compose). These are intended as templates for the user or agent to use within a local development environment and do not involve downloading or executing arbitrary scripts from untrusted remote sources.
Audit Metadata