turborepo
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill identifies a standard indirect prompt injection attack surface by processing user-provided arguments to modify monorepo configurations.
- Ingestion points: User requests are captured via the
$ARGUMENTSvariable incommand/turborepo.mdfor processing. - Boundary markers: The skill utilizes
<user-request>tags to encapsulate untrusted data, providing a clear delimiter between instructions and user-provided input. - Capability inventory: The agent is guided to modify critical configuration files such as
package.jsonandturbo.jsonacross the workspace. - Sanitization: There are no explicit instructions for the agent to sanitize or validate the user-provided request before applying changes to the configuration files.
- [COMMAND_EXECUTION]: The skill provides instructions for executing standard development and build orchestration commands.
- Runs
turbo run <tasks>to manage parallel task execution and individual package caching. - Utilizes
npx turbo-ignoreto optimize CI workflows by detecting unchanged packages and skipping unnecessary work. - Employs
turbo watchfor automated development loops and dependency-aware task restarts. - [EXTERNAL_DOWNLOADS]: The skill references and recommends tools and services from well-known providers and official sources.
- Directs users to official documentation and schemas at
turborepo.devandvercel.com. - Recommends common community utilities such as
syncpack,manypkg, andsheriffor managing workspace dependencies. - Provides guidance on configuring Vercel Remote Caching to accelerate builds across environments.
Audit Metadata