turborepo-vercel-monorepo
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a sibling skill installation using
npx skills@1.5.23. This command downloads and executes a tool from the author's own ecosystem (stealth-factory) to manage skill dependencies. - [COMMAND_EXECUTION]: GitHub Actions workflows (
js.yml,apple.yml) include steps to execute development commands such aspnpm install,turbo run, andxcodebuild. These are standard for CI/CD pipelines and are constrained to the runner environment. - [COMMAND_EXECUTION]: The
vercel.jsonconfiguration files for apps contain anignoreCommandthat executesgit diff. This is a documented Vercel optimization to skip unnecessary builds in monorepos. - [SAFE]: GitHub Actions are pinned using 40-character commit SHAs (e.g.,
actions/checkout@3d3c42e5...), which is a security best practice to prevent supply chain attacks via tag floating. - [SAFE]: The
.gitignoretemplate correctly includes patterns for sensitive files such as.env*.local,Secrets.xcconfig, andnode_modules/, ensuring local secrets are not accidentally committed to version control.
Audit Metadata