📦

Audit History

prisma-compute - 7 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v7 Latest	Jul 23, 2026, 05:35 PM	43 confirmed	16	No capability change
v6	Jul 21, 2026, 10:21 AM	1 confirmed	0	No capability change
v5	Jul 21, 2026, 10:21 AM	1 confirmed	0	No capability change
v4	Jul 21, 2026, 10:21 AM	1 confirmed	0	No capability change
v3	Jul 21, 2026, 10:21 AM	1 confirmed	0	No capability change
v2	Jul 21, 2026, 10:21 AM	1 confirmed	0	No capability change
v1	Jul 21, 2026, 10:21 AM	1 confirmed	0	Baseline

Audit version 7 Latest

Jul 23, 2026, 05:35 PM

No prompt injection or malicious collection endpoint was found; most static matches are Markdown or deployment documentation. The skill still handles secret-bearing environment files, executes mutable package versions, and documents non-interactive production mutations.

Files scanned

1,901

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (43)

High

references/app-deploy-cli.md:148

Environment file access

bunx @prisma/cli@latest project env add --file .env --role production

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:149

Environment file access

bunx @prisma/cli@latest project env add --file .env.preview --role preview

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:151

Environment file access

bunx @prisma/cli@latest project env update --file .env --role production

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:157

Environment file access

`app deploy --env .env` loads environment variables from a file for the deployment. A config-backed

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:247

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:263

Environment file access

--env .env.preview

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:281

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:292

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:303

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:317

Environment file access

--env .env.preview

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:329

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/app-deploy-cli.md:337

Environment file access

bunx @prisma/cli@latest app deploy api --prod --yes --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/compute-config.md:47

Environment file access

env: ".env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/compute-config.md:83

Environment file access

file: [".env", ".env.production"],

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/compute-config.md:141

Environment file access

env: "apps/web/.env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/compute-config.md:149

Environment file access

file: "apps/api/.env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/compute-config.md:83

Environment variant files

file: [".env", ".env.production"],

The configuration explicitly loads .env and .env.production files. These variants commonly contain deployment secrets and therefore require deliberate scope and repository controls.

High

references/create-prisma.md:65

Environment file access

- a `.env` file containing `DATABASE_URL`

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/create-prisma.md:66

Environment file access

- an initial Compute deployment with env vars loaded from `.env`

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:80

Environment file access

bunx @prisma/cli@latest app deploy --framework nextjs --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:107

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:118

Environment file access

env: ".env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:144

Environment file access

bunx @prisma/cli@latest app deploy --framework nestjs --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:153

Environment file access

env: ".env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:178

Environment file access

bunx @prisma/cli@latest app deploy --framework tanstack-start --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:222

Environment file access

bunx @prisma/cli@latest app deploy --framework nuxt --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:231

Environment file access

env: ".env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:243

Environment file access

bunx @prisma/cli@latest app deploy --framework astro --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:253

Environment file access

env: ".env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:280

Environment file access

--env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:313

Environment file access

env: ".env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:359

Environment file access

env: "packages/db/.env",

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/frameworks.md:379

Environment file access

--env packages/db/.env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/sdk-api.md:126

Environment file access

bunx @prisma/cli@latest project env add --file .env.preview --branch feature/foo

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/troubleshooting.md:22

Environment file access

test -f .env && sed -n 's/=.*/=<redacted>/p' .env

The command reads a local .env file and prints variable names while redacting values. Redaction reduces exposure, but access to a secret-bearing file is real.

High

references/troubleshooting.md:153

Environment file access

bunx @prisma/cli@latest app deploy --json --no-interactive --prod --yes --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/troubleshooting.md:197

Environment file access

1. Put a real production-ready `DATABASE_URL` in `.env` or project env.

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/troubleshooting.md:200

Environment file access

4. Redeploy with `--env .env` or project env configured.

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/troubleshooting.md:389

Environment file access

bunx @prisma/cli@latest app deploy --prod --yes --env .env

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

references/troubleshooting.md:390

Environment file access

bunx @prisma/cli@latest app deploy --branch feature/foo --env .env.preview

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

SKILL.md:148

Environment file access

- `env-deploy-loads-dotenv` - Generated deploy scripts may load env via `prisma.compute.ts` or `--en

The guidance configures a local .env file as deployment input, causing secret-bearing values to be read and potentially uploaded to Prisma Compute. This is intended but security-sensitive behavior.

High

SKILL.md:18-25 references/create-prisma.md:11-16

Unpinned Remote Package Execution

Commands repeatedly execute @prisma/cli@latest and create-prisma@latest through package runners. A compromised or unexpectedly changed release would execute with the agent's local privileges.

The cited commands explicitly use the mutable latest tag with bunx. Package runners download and execute that resolved release.

High

SKILL.md:157-164 references/app-deploy-cli.md:351-359

Production Mutation Confirmation Bypass

The skill documents production deploy, promotion, rollback, removal, and other remote mutations with non-interactive confirmation flags. Incorrect target inference could alter live infrastructure.

The cited guidance explicitly combines production operations with --yes. Intent guardrails are present, but the commands bypass interactive confirmation once run.

Capability review items (16)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/app-deploy-cli.md:150

Database connection strings

bunx @prisma/cli@latest project env add DATABASE_URL=postgresql://... --branch feature/foo

The guidance permits a database URL in command arguments, so substituted credentials can enter shell history or process listings. The example is legitimate but security-sensitive.

High

references/app-deploy-cli.md:152

Database connection strings

bunx @prisma/cli@latest project env update DATABASE_URL=postgresql://... --branch feature/foo

The guidance permits a database URL in command arguments, so substituted credentials can enter shell history or process listings. The example is legitimate but security-sensitive.

High

references/app-deploy-cli.md:165

Database connection strings

- Existing database env values supplied through `--env DATABASE_URL=...`, `--env DIRECT_URL=...`, an

The guidance permits a database URL in command arguments, so substituted credentials can enter shell history or process listings. The example is legitimate but security-sensitive.

High

references/create-prisma.md:65

Database connection strings

- a `.env` file containing `DATABASE_URL`

The documented workflow creates, reads, stores, or transmits a real DATABASE_URL. This is intended deployment behavior, but the value is a credential requiring strict redaction and scope controls.

High

references/sdk-api.md:47

Database connection strings

const databaseUrl = process.env.DATABASE_URL

The documented workflow creates, reads, stores, or transmits a real DATABASE_URL. This is intended deployment behavior, but the value is a credential requiring strict redaction and scope controls.

High

references/sdk-api.md:48

Database connection strings

if (!databaseUrl) throw new Error("DATABASE_URL is required")

The documented workflow creates, reads, stores, or transmits a real DATABASE_URL. This is intended deployment behavior, but the value is a credential requiring strict redaction and scope controls.

High

references/sdk-api.md:58

Database connection strings

envVars: { DATABASE_URL: databaseUrl },

The documented workflow creates, reads, stores, or transmits a real DATABASE_URL. This is intended deployment behavior, but the value is a credential requiring strict redaction and scope controls.

High

references/troubleshooting.md:197

Database connection strings

1. Put a real production-ready `DATABASE_URL` in `.env` or project env.

The documented workflow creates, reads, stores, or transmits a real DATABASE_URL. This is intended deployment behavior, but the value is a credential requiring strict redaction and scope controls.

Medium

references/compute-config.md:141

Hidden file access

env: "apps/web/.env",

The configuration or command explicitly references a hidden .env file as deployment input. That file commonly contains credentials and is read during the intended workflow.

Medium

references/compute-config.md:149

Hidden file access

file: "apps/api/.env",

The configuration or command explicitly references a hidden .env file as deployment input. That file commonly contains credentials and is read during the intended workflow.

Medium

references/frameworks.md:359

Hidden file access

env: "packages/db/.env",

The configuration or command explicitly references a hidden .env file as deployment input. That file commonly contains credentials and is read during the intended workflow.

Medium

references/frameworks.md:379

Hidden file access

--env packages/db/.env

The configuration or command explicitly references a hidden .env file as deployment input. That file commonly contains credentials and is read during the intended workflow.

Medium

references/sdk-api.md:35

Environment variable access (dot notation)

token: process.env.PRISMA_API_TOKEN,

The SDK example reads PRISMA_API_TOKEN from the process environment and supplies it to an authenticated client. This is legitimate secret access that requires redaction and least privilege.

Medium

references/sdk-api.md:47

Environment variable access (dot notation)

const databaseUrl = process.env.DATABASE_URL

The SDK example reads DATABASE_URL from the process environment before deployment. This is legitimate credential handling, but accidental logging or broad process access could expose it.

Medium

references/sdk-api.md:35

Environment variable object

token: process.env.PRISMA_API_TOKEN,

The SDK example reads PRISMA_API_TOKEN from the process environment and supplies it to an authenticated client. This is legitimate secret access that requires redaction and least privilege.

Medium

references/sdk-api.md:47

Environment variable object

const databaseUrl = process.env.DATABASE_URL

The SDK example reads DATABASE_URL from the process environment before deployment. This is legitimate credential handling, but accidental logging or broad process access could expose it.

Risk Factors

🌐 Network access (6)

references/app-deploy-cli.md:269 references/frameworks.md:296 references/troubleshooting.md:350 references/troubleshooting.md:351 SKILL.md:3 SKILL.md:128

🔑 Env variables (40)

references/app-deploy-cli.md:150 references/app-deploy-cli.md:152 references/app-deploy-cli.md:165 references/app-deploy-cli.md:195 references/compute-config.md:92 references/create-prisma.md:107 references/create-prisma.md:65 references/create-prisma.md:82 references/create-prisma.md:109 references/frameworks.md:127 references/frameworks.md:133 references/frameworks.md:162 references/frameworks.md:169 references/frameworks.md:289 references/frameworks.md:295 references/frameworks.md:127 references/frameworks.md:133 references/frameworks.md:162 references/frameworks.md:169 references/frameworks.md:289 references/frameworks.md:295 references/sdk-api.md:35 references/sdk-api.md:47 references/sdk-api.md:35 references/sdk-api.md:47 references/sdk-api.md:47 references/sdk-api.md:48 references/sdk-api.md:58 references/troubleshooting.md:333 references/troubleshooting.md:333 references/troubleshooting.md:187 references/troubleshooting.md:191 references/troubleshooting.md:197 references/troubleshooting.md:216 references/troubleshooting.md:244 SKILL.md:129 SKILL.md:129 SKILL.md:148 SKILL.md:147 SKILL.md:191

📁 Filesystem access (5)

references/compute-config.md:141 references/compute-config.md:149 references/frameworks.md:359 references/frameworks.md:379 references/troubleshooting.md:371

⚙️ External commands (50)

Audited by: codex

Audit version 6

Jul 21, 2026, 10:21 AM

All 226 static findings are false positives caused by documentation examples, Markdown backticks, deployment configuration, and benign scoped checks. No prompt injection, secret exfiltration, or malicious automation was found. The skill does recommend executing unpinned latest-tag packages, which creates a medium supply-chain risk.

Files scanned

1,901

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:18-23 references/app-deploy-cli.md:24-35

Unpinned Remote Package Execution Guidance

The skill recommends running packages through bunx with the latest tag. It also documents an installer that shells out to skills@latest. A compromised or changed upstream release could execute unexpected code.

The cited documentation explicitly uses @latest package execution and describes a secondary latest-tag installer. This is a clear supply-chain exposure, although it is not evidence of a current compromise.