Skills prisma-postgres
๐Ÿ“ฆ

prisma-postgres

v7.7.0 Content revision r2 High Risk ๐Ÿ”‘ Env variables๐ŸŒ Network accessโš™๏ธ External commands

Provision and Manage Prisma Postgres

Prisma Postgres setup spans several tools, authentication models, and connection methods. This skill selects the right workflow and provides focused operational guidance.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "prisma-postgres" from https://skillstore.io/skills/prisma-prisma-postgres.md and its manifest at https://skillstore.io/api/skills/prisma-prisma-postgres/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "prisma-postgres". Create a temporary database in Europe for a pull request preview.

Expected outcome:

  • Select eu-central-1 or eu-west-3 based on application latency and policy.
  • Set a short lifetime that covers the review window.
  • Keep the connection and claim URLs out of logs and source control.
  • Claim the database only when the preview must become persistent.

Using "prisma-postgres". Should a Node.js service use a direct or pooled Prisma Postgres endpoint?

Expected outcome:

Use the direct endpoint with the PostgreSQL adapter for a standard long-running Node.js service. Consider pooled or serverless options only when runtime constraints require them.

Using "prisma-postgres". Outline a secure OAuth SDK integration for customer workspaces.

Expected outcome:

  • Register an exact callback URL and request only required scopes.
  • Store OAuth state and the PKCE verifier securely before redirecting.
  • Persist encrypted tokens with strict tenant ownership checks.
  • Rotate refresh tokens, redact logs, and clear tokens during logout.

Security Audit

High Risk
v8 โ€ข 7/23/2026 Open versioned report

Static matches for database URLs, environment variables, official Prisma endpoints, and Markdown backticks are benign documentation examples rather than secret collection or command injection. The source contains no prompt injection or unauthorized exfiltration behavior. Separate semantic review identified unpinned npm execution and API keys passed in command arguments as risks requiring remediation.

5
Files scanned
476
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (2)

High
Unpinned npm Package Execution
The skill repeatedly recommends npx with @latest, including -y, so future package contents can execute without version review.
The cited commands explicitly fetch current npm releases, and -y removes confirmation for the Prisma CLI examples.
High
API Key Exposed in Process Arguments
Examples place an API key directly in process arguments. Shell history, process listings, CI logs, or debugging output can expose the credential.
Both cited examples pass the API key through a visible command-line flag, a standard exposure path for process arguments.
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/prisma-prisma-postgres/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/prisma-prisma-postgres/security.svg)](https://skillstore.io/skills/prisma-prisma-postgres?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/prisma-prisma-postgres?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/prisma-prisma-postgres/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/prisma-prisma-postgres.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

prisma. (2026). prisma-postgres security audit report (audit version 8) [Author version 7.7.0]. Skillstore. https://skillstore.io/skills/prisma-prisma-postgres/audits/8

BibTeX citation

@techreport{prisma-prisma-prisma-postgres-2026, author = {prisma}, title = {prisma-postgres security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/prisma-prisma-postgres/audits/8}, note = {Author version 7.7.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "prisma-postgres security audit report (audit version 8)" version: "7.7.0" type: report authors: - name: "prisma" date-released: "2026-07-23" url: "https://skillstore.io/skills/prisma-prisma-postgres/audits/8" identifiers: - type: other value: "skillstore:prisma-prisma-postgres:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
100
Maintainability
87
Content
65
Community
100
Spec Compliance

What You Can Build

Create Preview Databases

Choose a region, set a lifecycle, and obtain connection details for development, demonstrations, or temporary CI environments.

Automate Platform Provisioning

Plan service-token or OAuth workflows for creating and managing workspace, project, branch, and database resources.

Connect Existing Projects

Link a local Prisma project, configure DATABASE_URL, select an adapter, and prepare schema generation or migration.

Try These Prompts

Create a Development Database
Help me create a temporary Prisma Postgres database in [region]. Explain lifecycle, claim behavior, and safe connection-string handling before suggesting commands.
Link an Existing Project
Plan how to link my local Prisma project to database [database ID]. Include interactive and CI options without exposing API keys in arguments.
Design Service-Token Provisioning
Design a service-token provisioning flow for workspace [name]. Cover resource hierarchy, endpoint selection, credential storage, retries, and least privilege.
Review Multi-Tenant OAuth
Review an OAuth-based multi-tenant Prisma Management API architecture. Address state, PKCE verifier storage, token refresh, tenant isolation, audit logs, and secret rotation.

Best Practices

  • Pin npm package versions and review release notes before running provisioning commands.
  • Keep service tokens, API keys, claim URLs, and database URLs in an approved secret store.
  • Use least privilege, confirm the target workspace, and protect one-time connection details from logs.

Avoid

  • Do not place API keys directly in shell commands, chat messages, or CI logs.
  • Do not run destructive restore or removal operations without exact resource confirmation and backups.
  • Do not treat temporary databases, placeholder token storage, or example callback URLs as production defaults.

Frequently Asked Questions

Does this skill create databases automatically?
No. It provides workflow guidance and examples. Resource creation still requires an authorized Prisma account, reviewed commands, and network access.
Which provisioning method should I choose?
Use Console for manual work, create-db for temporary instances, Platform CLI for project resources, and Management API for application automation.
Are create-db databases permanent?
They are temporary by default and usually expire after about 24 hours. Use the claim flow when you need persistence.
How should Management API authentication work?
Use a service token for your workspace. Use OAuth when acting for users across workspaces, with secure state, verifier, and token storage.
Can I connect from serverless runtimes?
Yes. Select the serverless driver and adapter only when runtime constraints require them. Standard Node.js services usually use direct PostgreSQL connections.
How should I protect database credentials?
Use a secret store, restrict file access, exclude local environment files from version control, redact logs, and rotate any exposed credential.

Developer Details

Author

prisma

License

MIT

Author version

v7.7.0

Skillstore revision

r2

Ref

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

Maintenance freshness

7/25/2026

Usage

0 downloads ยท 0 views

File structure

๐Ÿ“ references/

๐Ÿ“„ console-and-connections.md

๐Ÿ“„ create-db-cli.md

๐Ÿ“„ management-api-sdk.md

๐Ÿ“„ management-api.md

๐Ÿ“„ SKILL.md

More from prisma

View all
View all