📦

mastra

Name: mastra
Author: mastra-ai

v2.0.0 Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables📁 Filesystem access

Build Mastra Agents with Current Docs

Mastra APIs change quickly, so older examples can create broken agents and workflows. This skill guides Claude, Codex, and Claude Code to verify current docs before writing code.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "mastra" from https://skillstore.io/skills/mastra-ai-mastra.md and its manifest at https://skillstore.io/api/skills/mastra-ai-mastra/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mastra-ai-mastra.md Signed manifest GET /api/skills/mastra-ai-mastra/manifest Signed lockfile GET /api/skills/mastra-ai-mastra/lockfile

Test it

Using "mastra". Help me start a Mastra project for a support agent.

Expected outcome:

The skill checks whether Mastra packages are installed.
It recommends a CLI or manual setup path.
It keeps provider keys as local placeholders.

Using "mastra". My workflow fails after the first step.

Expected outcome:

The skill compares the error with common workflow issues.
It verifies current workflow APIs from installed docs.
It suggests a focused fix and a test step.

Using "mastra". Upgrade my Mastra project to the latest version.

Expected outcome:

The skill starts with official migration guidance.
It checks installed package docs for exact signatures.
It produces a migration plan with validation steps.

Security Audit

High Risk

v4 • 7/5/2026 Open versioned report

Static findings are almost entirely documentation examples, Markdown formatting, official documentation URLs, localhost references, or placeholder environment variable usage. I found no prompt injection or hidden execution logic, but the setup guide does encourage users to provide an API key to the AI agent, which is a real secret-handling risk.

Files scanned

1,416

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

references/create-mastra.md:13-15 references/create-mastra.md:107-115

API Key Disclosure Encouraged During Automatic Setup

The setup guide offers an automatic setup option where the user gives the AI agent an API key. This can encourage users to paste real provider credentials into chat instead of storing them locally.

The wording explicitly asks for an API key for automatic setup, and later instructs creating a .env file with provider keys. This is a clear secret-handling risk, although there is no evidence of exfiltration code.

Risk Factors

⚙️ External commands (35)

🌐 Network access (17)

references/common-errors.md:511 references/common-errors.md:373 references/migration-guide.md:51 references/remote-docs.md:56 references/remote-docs.md:62 references/remote-docs.md:79 references/remote-docs.md:96 references/remote-docs.md:97 references/remote-docs.md:105 references/remote-docs.md:154 references/remote-docs.md:164 references/remote-docs.md:171 SKILL.md:8 SKILL.md:40 SKILL.md:66 SKILL.md:149 SKILL.md:159

🔑 Env variables (18)

📁 Filesystem access (1)

references/create-mastra.md:146

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/mastra-ai-mastra/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mastra-ai-mastra/security.svg)](https://skillstore.io/skills/mastra-ai-mastra?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mastra-ai-mastra?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mastra-ai-mastra/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mastra-ai-mastra.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

mastra-ai. (2026). mastra security audit report (audit version 4) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/mastra-ai-mastra/audits/4

BibTeX citation

@techreport{mastra-ai-mastra-ai-mastra-2026,
  author = {mastra-ai},
  title = {mastra security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/mastra-ai-mastra/audits/4},
  note = {Author version 2.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mastra security audit report (audit version 4)"
version: "2.0.0"
type: report
authors:
  - name: "mastra-ai"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/mastra-ai-mastra/audits/4"
identifiers:
  - type: other
    value: "skillstore:mastra-ai-mastra:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a Mastra project

Set up a new agent project with the right dependencies, TypeScript settings, and provider model format.

Fix framework errors

Diagnose common Mastra errors by checking local docs, current type definitions, and known troubleshooting patterns.

Plan a version upgrade

Compare current and target APIs, find migration guidance, and build a validation checklist before changing code.

Try These Prompts

Create a first agent

Use the Mastra skill to help me create a new Mastra project. Ask before running commands and use placeholders for secrets.

Verify an API

Use embedded Mastra docs to verify the Agent constructor for my installed version before changing my code.

Troubleshoot an error

Use the common errors reference and current docs to diagnose this Mastra error: [paste error]. Explain the likely cause and fix.

Plan a migration

Use the migration guide, embedded docs, and remote docs to plan a Mastra version upgrade. List breaking changes and validation steps.

Best Practices

Check embedded docs first when Mastra packages are installed.
Keep provider keys in local environment files or a secret manager.
Validate TypeScript settings and package versions before debugging APIs.

Avoid

Do not rely on model memory for Mastra API signatures.
Do not paste real API keys into chat for project setup.
Do not mix remote docs with older installed packages without checking versions.

Frequently Asked Questions

What does this skill help with?

It helps AI assistants build, debug, and migrate Mastra TypeScript agent projects using current documentation.

Why does it prefer embedded docs?

Embedded docs match the installed package version, so they reduce errors from outdated examples.

Can it create a full Mastra project?

It can guide project creation and file structure, but command execution should remain user approved.

Does it support Claude, Codex, and Claude Code?

Yes. The skill metadata lists Claude, Codex, and Claude Code as supported tools.

Should I provide real API keys to the assistant?

No. Use placeholders in generated files, then add real keys locally or through a secret manager.

When should remote docs be used?

Use remote docs when local packages are missing or when you need current conceptual guidance.

Developer Details

Author

mastra-ai

License

Apache-2.0

Author version

v2.0.0

Skillstore revision

Repository

https://github.com/mastra-ai/skills/tree/main/skills/mastra/

Ref

62e2a730c5cd74eab4c7164309d810de660fcea3

Maintenance freshness

7/18/2026

Usage

7 downloads · 115 views

File structure

📁 references/

📄 common-errors.md

📄 create-mastra.md

📄 embedded-docs.md

📄 migration-guide.md

📄 remote-docs.md

📄 SKILL.md