Audit History

Version	Date	Result	Change vs previous
v6 Latest	Jul 23, 2026, 05:29 PM	1 confirmed	No capability change
v5	Jul 21, 2026, 10:22 AM	No confirmed findings	No capability change
v4	Jul 21, 2026, 10:22 AM	No confirmed findings	No capability change
v3	Jul 21, 2026, 10:22 AM	No confirmed findings	No capability change
v2	Jul 21, 2026, 10:22 AM	No confirmed findings	No capability change
v1	Jul 21, 2026, 10:22 AM	No confirmed findings	Baseline

Jul 23, 2026, 05:29 PM

All 151 static findings are false positives caused by Markdown syntax, TypeScript templates, relative imports, environment configuration, SQL examples, and documentation links. No command execution, path traversal, environment-file reading, reconnaissance, unauthorized network behavior, or prompt injection was found. One medium concern remains because examples log raw query parameters without redaction and may expose sensitive data.

9

Files scanned

2,155

Lines analyzed

5

Review items

0

False positives ignored

Confirmed security concerns (1)

Medium

references/client-methods.md:77-80 references/constructor.md:195-198

Unredacted Query Parameter Logging

Examples print raw query parameters to console without redaction guidance. Parameters may contain personal data or credentials and enter retained application logs.

Both examples directly log e.params from Prisma query events. Query parameters commonly contain user data, and neither example recommends redaction or development-only use.

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (9)

references/client-methods.md:191 references/client-methods.md:209 references/constructor.md:8 references/constructor.md:97 references/constructor.md:136 references/raw-queries.md:30 references/raw-queries.md:43 references/raw-queries.md:53 SKILL.md:51

🔑 Env variables (25)

🌐 Network access (3)

SKILL.md:210 SKILL.md:211 SKILL.md:212

Audited by: codex

Audit version 5

Jul 21, 2026, 10:22 AM

All 151 static matches are false positives caused by Markdown, TypeScript, and Prisma documentation examples. The skill contains no executable scripts, prompt-injection text, credential exfiltration, filesystem traversal, or shell execution. Raw SQL examples explicitly distinguish parameterized safe usage from an unsafe concatenation example for educational purposes.

9

Files scanned

2,155

Lines analyzed

4

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (9)

references/client-methods.md:191 references/client-methods.md:209 references/constructor.md:8 references/constructor.md:97 references/constructor.md:136 references/raw-queries.md:30 references/raw-queries.md:43 references/raw-queries.md:53 SKILL.md:51

🔑 Env variables (25)

🌐 Network access (3)

SKILL.md:210 SKILL.md:211 SKILL.md:212

Audited by: claude

Audit version 4

Jul 21, 2026, 10:22 AM

All 151 static matches are false positives caused by Markdown, TypeScript, and Prisma documentation examples. The skill contains no executable scripts, prompt-injection text, credential exfiltration, filesystem traversal, or shell execution. Raw SQL examples explicitly distinguish parameterized safe usage from an unsafe concatenation example for educational purposes.

9

Files scanned

2,155

Lines analyzed

4

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (9)

references/client-methods.md:191 references/client-methods.md:209 references/constructor.md:8 references/constructor.md:97 references/constructor.md:136 references/raw-queries.md:30 references/raw-queries.md:43 references/raw-queries.md:53 SKILL.md:51

🔑 Env variables (25)

🌐 Network access (3)

SKILL.md:210 SKILL.md:211 SKILL.md:212

Audited by: claude

Audit version 3

Jul 21, 2026, 10:22 AM

All 151 static matches are false positives caused by Markdown, TypeScript, and Prisma documentation examples. The skill contains no executable scripts, prompt-injection text, credential exfiltration, filesystem traversal, or shell execution. Raw SQL examples explicitly distinguish parameterized safe usage from an unsafe concatenation example for educational purposes.

9

Files scanned

2,155

Lines analyzed

4

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (9)

references/client-methods.md:191 references/client-methods.md:209 references/constructor.md:8 references/constructor.md:97 references/constructor.md:136 references/raw-queries.md:30 references/raw-queries.md:43 references/raw-queries.md:53 SKILL.md:51

🔑 Env variables (25)

🌐 Network access (3)

SKILL.md:210 SKILL.md:211 SKILL.md:212

Audited by: claude

Audit version 2

Jul 21, 2026, 10:22 AM

All 151 static matches are false positives caused by Markdown, TypeScript, and Prisma documentation examples. The skill contains no executable scripts, prompt-injection text, credential exfiltration, filesystem traversal, or shell execution. Raw SQL examples explicitly distinguish parameterized safe usage from an unsafe concatenation example for educational purposes.

9

Files scanned

2,155

Lines analyzed

4

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (9)

references/client-methods.md:191 references/client-methods.md:209 references/constructor.md:8 references/constructor.md:97 references/constructor.md:136 references/raw-queries.md:30 references/raw-queries.md:43 references/raw-queries.md:53 SKILL.md:51

🔑 Env variables (25)

🌐 Network access (3)

SKILL.md:210 SKILL.md:211 SKILL.md:212

Audited by: claude

Audit version 1

Jul 21, 2026, 10:22 AM

All 151 static matches are false positives caused by Markdown, TypeScript, and Prisma documentation examples. The skill contains no executable scripts, prompt-injection text, credential exfiltration, filesystem traversal, or shell execution. Raw SQL examples explicitly distinguish parameterized safe usage from an unsafe concatenation example for educational purposes.

9

Files scanned

2,155

Lines analyzed

4

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (50)

📁 Filesystem access (9)

references/client-methods.md:191 references/client-methods.md:209 references/constructor.md:8 references/constructor.md:97 references/constructor.md:136 references/raw-queries.md:30 references/raw-queries.md:43 references/raw-queries.md:53 SKILL.md:51

🔑 Env variables (25)

🌐 Network access (3)

SKILL.md:210 SKILL.md:211 SKILL.md:212

Audited by: claude

Version comparison

Confirmed security concerns (1)

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors