turborepo-caching

Warn

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The self-hosted remote cache server template (Template 4) uses computed file paths based on user-controlled inputs. Specifically, req.params.hash and req.query.teamId are passed directly into path.join(CACHE_DIR, team, hash) for read and write operations. This pattern is vulnerable to path traversal attacks, potentially allowing an attacker to access or overwrite files outside the intended cache directory if the server is improperly exposed.
  • [COMMAND_EXECUTION]: The skill documents the use of various CLI tools including turbo, npm, npx, and shell commands like rm -rf node_modules. While standard for monorepo management, these instructions involve executing commands in the local and CI environments.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 29, 2026, 12:47 PM