📦
Audit History
prisma-next-quickstart - 1 audit
Audit version 1 Latest
Aug 17, 2026, 08:37 AM
Most static findings are false positives caused by Markdown backticks, documentation links, and ordinary Prisma environment configuration. Confirmed risks are direct .env inspection, passing DATABASE_URL through command arguments, and default CLI telemetry.
1
Files scanned
343
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Environment file access
- `.env` / `.env.example` — is `DATABASE_URL` set, or only the example?
The workflow explicitly directs the agent to read .env while checking DATABASE_URL. Reading the file can place unrelated secrets and database credentials into model context.
High
Environment file access
- [ ] **First-touch orientation:** read `prisma-next.config.ts`, the contract source, `db.ts`, and `
The workflow explicitly directs the agent to read .env while checking DATABASE_URL. Reading the file can place unrelated secrets and database credentials into model context.
Low
Agent-Invoked Commands Send Telemetry by Default
The skill states that every Prisma Next command sends anonymous telemetry after a notice and records agent invocation unless the user opts out.
The telemetry behavior and available opt-out controls are explicitly documented on line 200. The disclosure reduces surprise but does not remove the privacy consideration.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Database connection strings
pnpm prisma-next contract infer --db "$DATABASE_URL" --output src/prisma/contract.prisma
The documented command expands DATABASE_URL into a command-line argument. Connection credentials may become visible to local process inspection or command instrumentation.
High
Database connection strings
| Bring an existing DB into a PN contract | `prisma-next contract infer --db "$DATABASE_URL"` | this
The documented command expands DATABASE_URL into a command-line argument. Connection credentials may become visible to local process inspection or command instrumentation.
High
Database connection strings
- [ ] **Brownfield path:** ran `contract infer --db "$DATABASE_URL" --output src/prisma/contract.pri
The documented command expands DATABASE_URL into a command-line argument. Connection credentials may become visible to local process inspection or command instrumentation.
Risk Factors
⚙️ External commands (50)
SKILL.md:9-10 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:14 SKILL.md:15 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:34 SKILL.md:42 SKILL.md:43 SKILL.md:44 SKILL.md:45 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:60-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-74 SKILL.md:74 SKILL.md:80-84 SKILL.md:84 SKILL.md:85 SKILL.md:86 SKILL.md:88 SKILL.md:90 SKILL.md:96 SKILL.md:98-110 SKILL.md:110-112 SKILL.md:112-114 SKILL.md:114 SKILL.md:116 SKILL.md:120 SKILL.md:121 SKILL.md:122-123 SKILL.md:123 SKILL.md:124 SKILL.md:130 SKILL.md:138-146 SKILL.md:146 SKILL.md:147 SKILL.md:148-149 SKILL.md:149 SKILL.md:150-152 SKILL.md:152
🌐 Network access (3)
📁 Filesystem access (2)
Audited by: codex