prisma-composer
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical manual for the
@prisma/composerecosystem. It describes standard development workflows including project initialization, service configuration, and deployment to official Prisma infrastructure. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill provides best practices for handling sensitive data. It introduces the
SecretStringtype and theenvSecret()function to ensure that credentials likePRISMA_SERVICE_TOKENandSCHEDULER_API_KEYare managed via platform environment variables rather than hardcoded in source code. Secrets are redacted by the framework, which is a defensive security pattern. - [UNVERIFIABLE_DEPENDENCIES]: The skill references official Node.js packages from the
@prismascope (@prisma/composerand@prisma/composer-prisma-cloud). It mentions a plugin convention for extensions namedprisma-composer-*on npm, which is a standard ecosystem pattern. Users are advised to verify package existence on npm before use. - [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture that ingests user-defined schemas and code. It mitigates injection risks by enforcing schema validation through standard libraries (such as ArkType) and providing clear boundaries for service inputs.
Audit Metadata