turborepo
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches examples and documentation from Vercel's official Turborepo GitHub repository and documentation site.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to inspect and process local repository metadata files (e.g.,
package.json,turbo.json), which constitutes an attack surface for indirect prompt injection if those files contain malicious instructions. - Ingestion points: Root and package-level
package.json,turbo.json, and lockfiles. - Boundary markers: The skill instructions emphasize inspecting the local surface and verifying with narrow commands, but do not specify explicit prompt delimiters for untrusted file content.
- Capability inventory: The skill executes CLI commands via
turbo,bun, anddocker. - Sanitization: No explicit sanitization or filtering of external content is described before interpolation into the agent's context.
Audit Metadata