Turborepo Monorepo Testing
Warn
Audited by Gen Agent Trust Hub on Jun 4, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides scripts that use
child_process.execSyncwith direct string interpolation for executing system commands. - In
scripts/run-affected-tests.ts, the variablebaseBranch(sourced fromprocess.env.BASE_BRANCH) is interpolated into a shell command:`pnpm turbo test --filter=...[${baseBranch}] --dry-run=json`. This is a command injection vector if the environment variable is attacker-controlled. - In
packages/test-utils/src/helpers/setup-database.ts, the script executes`createdb ${databaseName}`and`dropdb --if-exists ${databaseName}`usingexecSync. While the current template uses UUIDs, the pattern itself is unsafe for variables that might be influenced by external inputs. - In
scripts/merge-coverage.ts, the script constructs a shell command using string concatenation of file paths and directory names:`npx nyc merge ${coverageFiles.map(...).join(' ')} ${mergedDir}/coverage.json`. This can be exploited if package names or directory structures contain shell metacharacters.
Audit Metadata