Skills prisma-postgres-setup

📦

prisma-postgres-setup

Name: prisma-postgres-setup
Author: prisma

v1.1.0 Content revision r2 High Risk 🌐 Network access🔑 Env variables⚙️ External commands

Provision Prisma Postgres for Local Projects

Manual database provisioning and Prisma 7 configuration require several coordinated API, dependency, and migration steps. This skill guides the complete setup and verification workflow.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "prisma-postgres-setup" from https://skillstore.io/skills/prisma-prisma-postgres-setup.md and its manifest at https://skillstore.io/api/skills/prisma-prisma-postgres-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/prisma-prisma-postgres-setup.md Signed manifest GET /api/skills/prisma-prisma-postgres-setup/manifest Signed lockfile GET /api/skills/prisma-prisma-postgres-setup/lockfile

Test it

Using "prisma-postgres-setup". Set up a new database for this empty Node.js project in an available European region.

Expected outcome:

Created a Prisma project and database in the selected region.
Configured Prisma 7 files and protected the environment file from Git commits.
Applied the initial migration and confirmed a successful database connection.

Using "prisma-postgres-setup". Connect my existing Prisma models to a new database without replacing the schema.

Expected outcome:

Preserved the existing models and configured the new database connection.
Created migration history after confirmation and generated the Prisma client.
Verified connectivity, then removed the temporary test file.

Using "prisma-postgres-setup". Provision a database, but stop before deleting anything.

Expected outcome:

Database creation stopped when the workspace limit was reached. Existing projects were listed, and no deletion occurred.

Security Audit

High Risk

v10 • 7/23/2026 Open versioned report

Ten static findings are confirmed: eight executable command spans and two operations involving secret-bearing environment files. Most alerts are Markdown, official Prisma URLs, placeholders, or standard local configuration. Contextual review found unsafe token handling and permanent project deletion, but no prompt injection or unrelated exfiltration.

Files scanned

721

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

SKILL.md:53

Environment file access

Check for `PRISMA_SERVICE_TOKEN` in the environment or `.env` file.

The workflow searches .env for a workspace-scoped service token, giving the agent access to a high-impact credential.

High

SKILL.md:138

Environment file access

2. Write the direct connection string to `.env`. **Append** to the file if it already exists — do no

The workflow appends a live database connection credential to a plaintext .env file, creating a secret-storage and file-modification risk.

High

SKILL.md:47-64 references/auth.md:31-40

Workspace Service Token Requested Through Chat

The workflow says, "Copy the token and paste it here," placing a workspace-scoped service token in model conversation history. The token grants access to every workspace resource.

The chat request is explicit, and the authentication reference confirms that the token covers every resource in the workspace.

High

SKILL.md:104-108 references/endpoints.md:217-223

Permanent Project Deletion in Quota Recovery

When creation reaches the database limit, the workflow deletes the project selected from a menu before retrying. Project deletion permanently removes all databases.

The main workflow directs deletion after selection, and the endpoint reference explicitly states that every project database is permanently deleted.

Medium

SKILL.md:64-72 SKILL.md:83-86

Bearer Token Exposed in Command Arguments

The curl examples expand the bearer token into command arguments. Local process inspection, shell tracing, or command logging can expose the workspace credential.

The examples interpolate the shell variable directly into curl header arguments, which exposes the expanded value to local command observability.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:70-73

Ruby/shell backtick execution

```bash

This fenced Bash span runs curl with a bearer token against Prisma, creating command-line credential exposure and an authenticated network action.

Medium

SKILL.md:83-92

Ruby/shell backtick execution

```bash

This fenced Bash span performs an authenticated POST that creates remote Prisma resources and expands the bearer token into command arguments.

Medium

SKILL.md:114-119

Ruby/shell backtick execution

```bash

This fenced Bash span performs an authenticated POST that creates a named database connection and returns a new credential.

Medium

SKILL.md:127-129

Ruby/shell backtick execution

```bash

The npm install command modifies project dependencies and can execute package lifecycle scripts, so it is real external command execution.

Medium

SKILL.md:148

Ruby/shell backtick execution

5. If `prisma/schema.prisma` does not exist, run `npx prisma init` to scaffold the project. This cre

The npx command executes the Prisma CLI and writes project files, with possible package download when the binary is unavailable locally.

Medium

SKILL.md:189-191

Ruby/shell backtick execution

```bash

The migration command executes Prisma tooling, writes migration files, and changes the connected database schema.

Medium

SKILL.md:195

Ruby/shell backtick execution

Only use `npx prisma db push` if the user explicitly asks for prototyping-only mode (no migration hi

The documented npx commands can push schema changes directly and regenerate client artifacts, causing real local and database modifications.

Medium

SKILL.md:222-224

Ruby/shell backtick execution

```bash

The npx command executes a generated TypeScript file with database credentials and issues a query against the provisioned database.

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/prisma-prisma-postgres-setup/security.svg)](https://skillstore.io/skills/prisma-prisma-postgres-setup?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/prisma-prisma-postgres-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/prisma-prisma-postgres-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/prisma-prisma-postgres-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

prisma. (2026). prisma-postgres-setup security audit report (audit version 10) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10

BibTeX citation

@techreport{prisma-prisma-prisma-postgres-setup-2026,
  author = {prisma},
  title = {prisma-postgres-setup security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10},
  note = {Author version 1.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "prisma-postgres-setup security audit report (audit version 10)"
version: "1.1.0"
type: report
authors:
  - name: "prisma"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10"
identifiers:
  - type: other
    value: "skillstore:prisma-prisma-postgres-setup:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Start a New Prisma Application

Provision a development database, configure Prisma 7, create a starter schema, and verify connectivity.

Standardize Team Setup

Apply one repeatable database and client configuration process across local Node.js projects.

Prepare a Migration Baseline

Connect existing models to a new database and create reviewed migration history for later deployment.

Try These Prompts

Set Up a New Project

Set up Prisma Postgres for this Node.js project. Ask before creating cloud resources, changing files, installing packages, or running migrations.

Create a Starter Database

Provision a Prisma Postgres database in my chosen available region. Configure Prisma 7, add a starter blog schema, then verify the connection.

Preserve Existing Models

Connect this existing Prisma 7 codebase to a new Prisma Postgres database. Preserve existing models and create an initial migration after my confirmation.

Run a Controlled Provisioning Audit

Audit this repository for Prisma 7 readiness, propose required changes, provision a development connection, migrate safely, and report every local and remote modification.

Best Practices

Use a short-lived service token and rotate it after setup.
Review region, project name, schema, and destructive actions before confirmation.
Keep environment files ignored and inspect migrations before applying them.

Avoid

Do not paste production credentials into source files or commit environment files.
Do not delete projects automatically when a workspace limit is reached.
Do not use schema push when migration history is required.