turborepo

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides standard initialization commands using npx create-turbo@latest, which is the official project scaffold for Turborepo (a Vercel product).
  • [SAFE]: Environment variable handling in the Supabase shared package uses the NEXT_PUBLIC_ prefix, which correctly follows the convention for non-sensitive, client-side accessible keys (URL and Anon Key).
  • [SAFE]: The turbo.json configuration for globalDependencies correctly includes .env.*local files to ensure cache invalidation when local configurations change, which is a development best practice.
  • [SAFE]: Workspace configurations in pnpm-workspace.yaml and dependencies in package.json files use standard, well-known libraries such as Zod, Supabase, and TypeScript.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 10:18 PM
Security Audit — agent-trust-hub — turborepo