skills/ehyland/skills/turborepo/Gen Agent Trust Hub

turborepo

Pass

Audited by Gen Agent Trust Hub on Mar 3, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes structured configuration data from the user's repository, creating a surface for indirect prompt injection.
  • Ingestion points: The agent reads turbo.json, package.json, and .env files to identify task pipelines and environment configurations (see SKILL.md and command/turborepo.md).
  • Boundary markers: No specific boundary markers or instructions to disregard natural language commands embedded in these files are provided.
  • Capability inventory: The skill enables the agent to execute turbo commands and other monorepo tools (e.g., npx turbo-ignore) using the command/turborepo.md workflow.
  • Sanitization: No content validation is performed to filter out potentially malicious instructions in the processed repository files.
  • [EXTERNAL_DOWNLOADS]: Fetches and executes the turbo-ignore tool from the npm registry using npx during Vercel deployment workflows. This reference to Vercel's official utility is documented neutrally.
  • [COMMAND_EXECUTION]: Orchestrates various monorepo operations using the Turborepo CLI, including turbo run, turbo watch, and turbo boundaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 3, 2026, 09:32 AM