prisma-composer

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a technical manual for the @prisma/composer ecosystem. It describes standard development workflows including project initialization, service configuration, and deployment to official Prisma infrastructure.
  • [DATA_EXPOSURE_&_EXFILTRATION]: The skill provides best practices for handling sensitive data. It introduces the SecretString type and the envSecret() function to ensure that credentials like PRISMA_SERVICE_TOKEN and SCHEDULER_API_KEY are managed via platform environment variables rather than hardcoded in source code. Secrets are redacted by the framework, which is a defensive security pattern.
  • [UNVERIFIABLE_DEPENDENCIES]: The skill references official Node.js packages from the @prisma scope (@prisma/composer and @prisma/composer-prisma-cloud). It mentions a plugin convention for extensions named prisma-composer-* on npm, which is a standard ecosystem pattern. Users are advised to verify package existence on npm before use.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture that ingests user-defined schemas and code. It mitigates injection risks by enforcing schema validation through standard libraries (such as ArkType) and providing clear boundaries for service inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 10:53 AM
Security Audit — agent-trust-hub — prisma-composer