prisma-next-upgrade

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill queries the npm registry via npm view @prisma-next/postgres dist-tags.latest to identify the latest available version for upgrades. This is standard behavior for package management tools.
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to manage the upgrade lifecycle, including pnpm install for dependency resolution, pnpm typecheck and pnpm test for validation, and git commands to commit each upgrade step. These actions are restricted to the project scope.
  • [DYNAMIC_EXECUTION]: The skill invokes several bundled TypeScript and Shell scripts (e.g., strip-sha256-hash-prefixes.ts, re-emit-closed-mongo-contracts.ts) to perform specific code transformations. These scripts are executed using pnpm exec tsx or bash, which is the intended mechanism for applying version-specific migrations.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project-sensitive files including package.json, prisma-next.config.ts, and database migration files (migration.ts, contract.json). While these files are processed by the agent, the risk is mitigated by the deterministic nature of the transformation scripts provided by the vendor.
  • Ingestion points: package.json, pnpm-lock.yaml, prisma-next.config.ts, migration.ts, *.prisma, contract.json.
  • Boundary markers: None explicitly used in prompts, though transformations are handled by specialized scripts.
  • Capability inventory: File system read/write, shell command execution (pnpm, bash, tsx, git).
  • Sanitization: Scripts use regular expressions and structured JSON parsing to update project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 02:51 PM
Security Audit — agent-trust-hub — prisma-next-upgrade