turborepo-caching
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The self-hosted remote cache server template (Template 4) uses computed file paths based on user-controlled inputs. Specifically,
req.params.hashandreq.query.teamIdare passed directly intopath.join(CACHE_DIR, team, hash)for read and write operations. This pattern is vulnerable to path traversal attacks, potentially allowing an attacker to access or overwrite files outside the intended cache directory if the server is improperly exposed. - [COMMAND_EXECUTION]: The skill documents the use of various CLI tools including
turbo,npm,npx, and shell commands likerm -rf node_modules. While standard for monorepo management, these instructions involve executing commands in the local and CI environments.
Audit Metadata