The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes a Node.js Express server template (Template 4) for self-hosting a remote build cache. This script uses path.join with unsanitized user inputs from req.params.hash and req.query.teamId to determine file paths for storage and retrieval.
[DATA_EXFILTRATION]: The server template is vulnerable to path traversal because it does not validate or sanitize the hash and teamId parameters. An attacker could craft requests using ../ sequences to read sensitive files from the host filesystem (e.g., via the GET artifact endpoint) or overwrite critical files (via the PUT artifact endpoint).
[INDIRECT_PROMPT_INJECTION]: The skill configures Turborepo to use remote caching, which introduces a risk where malicious build artifacts could be injected into the project environment.
Ingestion points: Build artifacts are fetched from the remote cache API (e.g., Vercel or a self-hosted server) during npx turbo build.
Boundary markers: There are no integrity checks or signature validations implemented in the provided configuration templates to verify the authenticity of the cached artifacts.
Capability inventory: The build pipeline has broad capabilities, including writing to the local filesystem and executing task-specific code (e.g., in dist/ or .next/ directories) after the cache is restored.
Sanitization: The skill lacks any mechanism to sanitize or validate the content of the downloaded cache artifacts before they are integrated into the build process.

turborepo-caching