Audit History

Version	Date	Result	Review items	Change vs previous
v10 Latest	Jul 23, 2026, 05:58 PM	5 confirmed	8	No capability change
v9	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v8	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v7	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v6	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v5	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v4	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v3	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v2	Jul 21, 2026, 10:22 AM	No confirmed findings	0	No capability change
v1	Jul 21, 2026, 10:22 AM	No confirmed findings	0	Baseline

Jul 23, 2026, 05:58 PM

Ten static findings are confirmed: eight executable command spans and two operations involving secret-bearing environment files. Most alerts are Markdown, official Prisma URLs, placeholders, or standard local configuration. Contextual review found unsafe token handling and permanent project deletion, but no prompt injection or unrelated exfiltration.

5

Files scanned

721

Lines analyzed

16

Review items

0

False positives ignored

Confirmed security concerns (5)

High

SKILL.md:53

Environment file access

Check for `PRISMA_SERVICE_TOKEN` in the environment or `.env` file.

The workflow searches .env for a workspace-scoped service token, giving the agent access to a high-impact credential.

High

SKILL.md:138

Environment file access

2. Write the direct connection string to `.env`. **Append** to the file if it already exists — do no

The workflow appends a live database connection credential to a plaintext .env file, creating a secret-storage and file-modification risk.

High

SKILL.md:47-64 references/auth.md:31-40

Workspace Service Token Requested Through Chat

The workflow says, "Copy the token and paste it here," placing a workspace-scoped service token in model conversation history. The token grants access to every workspace resource.

The chat request is explicit, and the authentication reference confirms that the token covers every resource in the workspace.

High

SKILL.md:104-108 references/endpoints.md:217-223

Permanent Project Deletion in Quota Recovery

When creation reaches the database limit, the workflow deletes the project selected from a menu before retrying. Project deletion permanently removes all databases.

The main workflow directs deletion after selection, and the endpoint reference explicitly states that every project database is permanently deleted.

Medium

SKILL.md:64-72 SKILL.md:83-86

Bearer Token Exposed in Command Arguments

The curl examples expand the bearer token into command arguments. Local process inspection, shell tracing, or command logging can expose the workspace credential.

The examples interpolate the shell variable directly into curl header arguments, which exposes the expanded value to local command observability.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:70-73 SKILL.md:83-92 SKILL.md:114-119 SKILL.md:127-129 SKILL.md:189-191 SKILL.md:222-224

Ruby/shell backtick execution · 6 occurrences

```bash

This fenced Bash span runs curl with a bearer token against Prisma, creating command-line credential exposure and an authenticated network action.

Medium

SKILL.md:148

Ruby/shell backtick execution

5. If `prisma/schema.prisma` does not exist, run `npx prisma init` to scaffold the project. This cre

The npx command executes the Prisma CLI and writes project files, with possible package download when the binary is unavailable locally.

Medium

SKILL.md:195

Ruby/shell backtick execution

Only use `npx prisma db push` if the user explicitly asks for prototyping-only mode (no migration hi

The documented npx commands can push schema changes directly and regenerate client artifacts, causing real local and database modifications.

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: codex

Audit version 9

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 8

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 7

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 6

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 5

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 4

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 3

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 2

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Audit version 1

Jul 21, 2026, 10:22 AM

All 128 static detections are false positives caused by Markdown formatting, documented Prisma API endpoints, and expected database credential configuration. The skill provisions a Prisma Postgres database only through the stated API workflow and includes safeguards for interactive choices, environment-file protection, and destructive deletion confirmation. No prompt injection, credential exfiltration, hidden execution, or unrelated network activity was found.

5

Files scanned

721

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

🌐 Network access (17)

references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239

🔑 Env variables (23)

⚙️ External commands (50)

Audited by: claude

Version comparison

Confirmed security concerns (5)

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors