turborepo
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and guidance for using Turborepo, a build system for JavaScript/TypeScript monorepos. All documented tools and references are associated with the official Turborepo project or trusted vendors like Vercel.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
npx turbo-ignoreand various package managers (pnpm,npm,yarn,bun) to install dependencies and execute helper scripts. These are standard development operations from trusted sources. - [DATA_EXFILTRATION]: The instructions guide the agent in configuring remote caching, which involves the use of sensitive environment variables such as
TURBO_TOKEN. The skill correctly emphasizes storing these values in secure secret management systems rather than hardcoding them. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves processing user requests and repository configuration files to automate task setup. While this interaction is necessary for the skill's primary function, it defines a clear logic flow and references specific documentation to minimize the risk of malicious data influencing the agent's behavior.
Audit Metadata