turborepo-vercel-monorepo

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references a sibling skill installation using npx skills@1.5.23. This command downloads and executes a tool from the author's own ecosystem (stealth-factory) to manage skill dependencies.
  • [COMMAND_EXECUTION]: GitHub Actions workflows (js.yml, apple.yml) include steps to execute development commands such as pnpm install, turbo run, and xcodebuild. These are standard for CI/CD pipelines and are constrained to the runner environment.
  • [COMMAND_EXECUTION]: The vercel.json configuration files for apps contain an ignoreCommand that executes git diff. This is a documented Vercel optimization to skip unnecessary builds in monorepos.
  • [SAFE]: GitHub Actions are pinned using 40-character commit SHAs (e.g., actions/checkout@3d3c42e5...), which is a security best practice to prevent supply chain attacks via tag floating.
  • [SAFE]: The .gitignore template correctly includes patterns for sensitive files such as .env*.local, Secrets.xcconfig, and node_modules/, ensuring local secrets are not accidentally committed to version control.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 06:43 PM