{"data":{"skill":{"slug":"prisma-prisma-mongodb-upgrade","name":"prisma-mongodb-upgrade","icon":"📦","repo":"https://github.com/prisma/skills/tree/1a9f427e9fe2137298abbcc1a6f372db92e8c40d/prisma-mongodb-upgrade","status":"approved","author":"prisma","authorVersion":"0.1.0","skillstoreRevision":2},"audit":{"id":"77ae5e0e-995e-4f2e-a177-99365706712b","skill_id":"a0920818-63b8-4621-ad0c-c5ea5802e43d","version":9,"content_hash":"v3:ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006:c43759e8d8d640bb94963ab68aec9c906e5a8a3054845716b43c8ea87608d346:c1ae18d2472846de414e0108c8bcd251100f09ba36bd671b8ebc284f5595ec52:736b696c6c732f707269736d612f707269736d612d6d6f6e676f64622d75706772616465:4c1e0c199fec0ca56167c6f7c8837d09","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 24 static findings are false positives caused by documentation links, inline code, and command names in Markdown. No executable scripts, credential access, unsafe network behavior, or prompt injection was found.","remediation":[],"risk_factor_evidence":[{"factor":"env_access","evidence":[{"file":"references/decision-stay-or-migrate.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":63,"line_start":63}]},{"factor":"external_commands","evidence":[{"file":"references/migrations-mapping.md","line_end":52,"line_start":50},{"file":"references/migrations-mapping.md","line_end":59,"line_start":58},{"file":"references/migrations-mapping.md","line_end":60,"line_start":59},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":52,"line_start":52},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":64,"line_start":64},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":72,"line_start":72},{"file":"SKILL.md","line_end":73,"line_start":73},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":75,"line_start":75},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":90,"line_start":90}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":80,"line_start":80}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":6,"total_lines":423,"audit_model":"codex","audited_at":"2026-07-23T17:48:44.727+00:00","created_at":"2026-07-25T23:49:20.6812+00:00","static_findings":[{"id":"env_access:references/decision-stay-or-migrate.md:80:database-connection-strings","file":"references/decision-stay-or-migrate.md","pattern":"Database connection strings","snippet":"- Keep the classic setup (`url = env(\"DATABASE_URL\")` in the schema; `db push`; no SQL","category":"env_access","line_end":80,"severity":"high","line_start":80},{"id":"external_commands:references/migrations-mapping.md:50:ruby-shell-backtick-execution","file":"references/migrations-mapping.md","pattern":"Ruby/shell backtick execution","snippet":"Porting the v6 habit: run the Next equivalent of `db push` for every change in production,","category":"external_commands","line_end":52,"severity":"medium","line_start":50},{"id":"external_commands:references/migrations-mapping.md:58:ruby-shell-backtick-execution","file":"references/migrations-mapping.md","pattern":"Ruby/shell backtick execution","snippet":"migrate, let verify gate the marker, and sign. Reserve `db update` for local prototyping,","category":"external_commands","line_end":59,"severity":"medium","line_start":58},{"id":"external_commands:references/migrations-mapping.md:59:ruby-shell-backtick-execution","file":"references/migrations-mapping.md","pattern":"Ruby/shell backtick execution","snippet":"mirroring how `db push` was used on v6.","category":"external_commands","line_end":60,"severity":"medium","line_start":59},{"id":"blocker:references/schema-contract-mapping.md:22:system-reconnaissance","file":"references/schema-contract-mapping.md","pattern":"System reconnaissance","snippet":"| `@id @default(auto()) @map(\"_id\") @db.ObjectId` ([using ObjectId](https://www.prisma.io/docs/orm/o","category":"blocker","line_end":22,"severity":"low","line_start":22},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"there. The `prisma-upgrade-v7` guide does not apply to MongoDB projects.","category":"external_commands","line_end":22,"severity":"medium","line_start":22},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Prisma ORM v6 | Fully supported (`mongodb` provider); latest 6.x is the current stable path; maint","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| No blockers below apply | Migrate to Next; run the `verify-cutover-checklist` and share feedback w","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Codebase uses multi-document transactions (`$transaction`) — check with grep, do not ask | Plan ra","category":"external_commands","line_end":52,"severity":"medium","line_start":52},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Risk-averse but interested | Run a staged Next round-trip on a copy (see `verify-cutover-checklist","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Keep the classic v6 MongoDB setup: `url = env(\"DATABASE_URL\")` in the schema, `db push`","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"workflow, no SQL driver adapters (see `prisma-database-setup` for the v6 MongoDB shape).","category":"external_commands","line_end":64,"severity":"medium","line_start":64},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `references/decision-stay-or-migrate.md` | The full decision framing, blocker checks, and stay-hyg","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `references/schema-contract-mapping.md` | v6 schema (`mongodb` provider, `@db.ObjectId`, composite","category":"external_commands","line_end":72,"severity":"medium","line_start":72},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `references/client-api-mapping.md` | v6 client calls → Next equivalents, incl. raw escape hatches ","category":"external_commands","line_end":73,"severity":"medium","line_start":73},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `references/migrations-mapping.md` | v6 `db push`-only story → Next's plan/migrate/verify/sign flo","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `references/verify-cutover-checklist.md` | No-data-moves verification: same DB, index parity, stag","category":"external_commands","line_end":75,"severity":"medium","line_start":75},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`a2791c5dd59d579b4b3052942ae7f8fe5e2ee852` (pre-1.0, ~v0.14/0.15 line). Prisma Next moves","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"version actually installed** (check the project's `@prisma-next/*` versions and the","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`mongodb@^7` as a user-supplied peer dependency.","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"documentation. After a project switches to Prisma Next, run Prisma Next's `init`/skill","category":"external_commands","line_end":90,"severity":"medium","line_start":90},{"id":"network:SKILL.md:14:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"is [Prisma Next](https://github.com/prisma/prisma-next), where MongoDB support is in Early","category":"network","line_end":14,"severity":"low","line_start":14},{"id":"network:SKILL.md:80:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"[prisma/prisma-next](https://github.com/prisma/prisma-next) at commit","category":"network","line_end":80,"severity":"low","line_start":80},{"id":"env_access:SKILL.md:63:database-connection-strings","file":"SKILL.md","pattern":"Database connection strings","snippet":"- Keep the classic v6 MongoDB setup: `url = env(\"DATABASE_URL\")` in the schema, `db push`","category":"env_access","line_end":63,"severity":"high","line_start":63}],"finding_verdicts":[{"id":"env_access:references/decision-stay-or-migrate.md:80:database-connection-strings","reason":"The line documents standard Prisma schema syntax for referencing DATABASE_URL; it neither reads nor exposes an environment value.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/migrations-mapping.md:50:ruby-shell-backtick-execution","reason":"Backticks format the db push command name inside a negative prose example; no shell or Ruby execution exists.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/migrations-mapping.md:58:ruby-shell-backtick-execution","reason":"The text describes migration lifecycle stages and formats db update as Markdown; it contains no executable command mechanism.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:references/migrations-mapping.md:59:ruby-shell-backtick-execution","reason":"The backticked db push phrase is a comparison to a v6 workflow, not shell backtick substitution.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/schema-contract-mapping.md:22:system-reconnaissance","reason":"The line maps MongoDB ObjectId schema notation and links to Prisma documentation; it performs no system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:22:ruby-shell-backtick-execution","reason":"The backticks identify another guide by name in prose; there is no command execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The backticks format the mongodb provider value in a documentation table and are not executable syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The line names a local checklist reference in Markdown; it does not invoke a shell.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:52:ruby-shell-backtick-execution","reason":"The line recommends searching project code for transaction usage, but the backticks only format an API name.","verdict":"false_positive","confidence":0.98},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The backticks identify a local checklist document in prose and cannot execute a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"Inline code documents Prisma configuration and the db push workflow; the skill contains no execution wrapper.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:64:ruby-shell-backtick-execution","reason":"The backticks format the name of a related skill and are ordinary Markdown.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The line lists a bundled reference file and contains no executable shell construct.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:72:ruby-shell-backtick-execution","reason":"The line lists schema notation and a bundled reference file using Markdown code formatting only.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:73:ruby-shell-backtick-execution","reason":"The line lists a bundled client API reference and does not execute external commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"Backticks format a reference filename and a Prisma command name in a documentation table.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:75:ruby-shell-backtick-execution","reason":"The line lists a bundled verification checklist and contains no command invocation.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The backticked value is a source commit identifier used for provenance, not executable content.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The line formats a package scope while advising version verification; it does not run a command.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The backticked value is a package version requirement, not Ruby or shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The line recommends Prisma Next initialization after migration, but only names the command in Markdown.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:14:hardcoded-url","reason":"The URL is a visible documentation link to the official Prisma Next GitHub repository; no network request is implemented.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:80:hardcoded-url","reason":"The URL cites the official repository used to verify behavioral claims and is not contacted automatically.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SKILL.md:63:database-connection-strings","reason":"The line shows the conventional DATABASE_URL environment reference without accessing, printing, or transmitting its value.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","subject_content_hash":"c43759e8d8d640bb94963ab68aec9c906e5a8a3054845716b43c8ea87608d346","subject_tree_hash":"c1ae18d2472846de414e0108c8bcd251100f09ba36bd671b8ebc284f5595ec52","subject_plugin_path":"skills/prisma/prisma-mongodb-upgrade","audit_payload_hash":"4c1e0c199fec0ca56167c6f7c8837d09","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006","contentHash":"c43759e8d8d640bb94963ab68aec9c906e5a8a3054845716b43c8ea87608d346","treeHash":"c1ae18d2472846de414e0108c8bcd251100f09ba36bd671b8ebc284f5595ec52","pluginPath":"skills/prisma/prisma-mongodb-upgrade","auditPayloadHash":"4c1e0c199fec0ca56167c6f7c8837d09"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/prisma-prisma-mongodb-upgrade/audits/9/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}