turborepo
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a documentation and orchestration helper for Turborepo, a legitimate build system. It encourages security best practices such as using strict environment variable filtering, avoiding sensitive data in global dependencies, and enforcing package boundaries.\n- [INDIRECT_PROMPT_INJECTION]: The skill operates on project configuration files like turbo.json and package.json to manage builds. While these files are external inputs, the skill provides specific guidance on isolation and sanitization.\n
- Ingestion points: Processes turbo.json, package.json, and project source files in apps/ and packages/ directories.\n
- Boundary markers: Includes an experimental boundaries feature to enforce package isolation and tag-based dependency rules.\n
- Capability inventory: Orchestrates task execution (turbo run), interacts with the local file system for caching, and supports network operations for remote caching with Vercel or self-hosted servers.\n
- Sanitization: Recommends env-mode: strict to filter environment variables and explicit inputs declarations to ensure cache integrity.
Audit Metadata