prisma-compute

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is authored by 'prisma' and exclusively utilizes official vendor resources, including the @prisma/cli and @prisma/compute-sdk packages. All external references are to trusted domains (prisma.io, prisma.com) and official GitHub repositories.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use standard package runners (bunx, npx, pnpm dlx) to execute official Prisma tools. These operations are within the scope of the skill's intended purpose for deployment and scaffolding.
  • [CREDENTIALS_UNSAFE]: No hardcoded credentials or secret values were found. The skill includes multiple security guardrails, such as 'env-do-not-leak-secrets', which explicitly forbids the agent from printing DATABASE_URL, service tokens, or other sensitive values in logs or terminal output.
  • [PROMPT_INJECTION]: A static detector flag for concealment was evaluated as a false positive. The skill uses standard automation flags like --json and --no-interactive to facilitate machine-readable responses during CLI operations, which is normal behavior for agent-integrated tools and does not constitute a malicious attempt to hide actions from the user.
  • [DATA_EXFILTRATION]: While the skill uses curl to verify public deployment URLs, this is a legitimate step for confirming successful hosting. No evidence of unauthorized data transfer to third-party or untrusted domains was detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 11:56 PM