skills/shipshitdev/skills/turborepo/Gen Agent Trust Hub

turborepo

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill identifies a standard indirect prompt injection attack surface by processing user-provided arguments to modify monorepo configurations.
  • Ingestion points: User requests are captured via the $ARGUMENTS variable in command/turborepo.md for processing.
  • Boundary markers: The skill utilizes <user-request> tags to encapsulate untrusted data, providing a clear delimiter between instructions and user-provided input.
  • Capability inventory: The agent is guided to modify critical configuration files such as package.json and turbo.json across the workspace.
  • Sanitization: There are no explicit instructions for the agent to sanitize or validate the user-provided request before applying changes to the configuration files.
  • [COMMAND_EXECUTION]: The skill provides instructions for executing standard development and build orchestration commands.
  • Runs turbo run <tasks> to manage parallel task execution and individual package caching.
  • Utilizes npx turbo-ignore to optimize CI workflows by detecting unchanged packages and skipping unnecessary work.
  • Employs turbo watch for automated development loops and dependency-aware task restarts.
  • [EXTERNAL_DOWNLOADS]: The skill references and recommends tools and services from well-known providers and official sources.
  • Directs users to official documentation and schemas at turborepo.dev and vercel.com.
  • Recommends common community utilities such as syncpack, manypkg, and sherif for managing workspace dependencies.
  • Provides guidance on configuring Vercel Remote Caching to accelerate builds across environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 10:53 AM
Security Audit — agent-trust-hub — turborepo