Audit History

All 268 static findings are false positives caused by documentation examples, Markdown syntax, fixed paths, environment placeholders, and official links. Three semantic findings remain: disabled TLS verification, unredacted query-argument logging, and an unguarded forced database reset. The skill shows no prompt injection, credential exfiltration, or hidden executable payload.

This is a legitimate, Prisma-authored documentation skill guiding a Prisma ORM v6-to-v7 migration; it contains only Markdown prose and illustrative code snippets, no executable install scripts. All 268 static findings were adjudicated as false positives: the 'path traversal' hits are standard `../generated/prisma` generator output/import paths, the env_access and sensitive hits are ordinary `process.env.DATABASE_URL` / `dotenv` / `.env` documentation patterns with only ellipsis placeholders (no live secrets), and the 'shell backtick execution' hits are Markdown code fences and JavaScript template literals. One low-severity semantic note flags a troubleshooting suggestion to disable TLS certificate verification, which is clearly framed as a legacy fallback with a secure alternative offered alongside it.

This is a legitimate, Prisma-authored documentation skill guiding a Prisma ORM v6-to-v7 migration; it contains only Markdown prose and illustrative code snippets, no executable install scripts. All 268 static findings were adjudicated as false positives: the 'path traversal' hits are standard `../generated/prisma` generator output/import paths, the env_access and sensitive hits are ordinary `process.env.DATABASE_URL` / `dotenv` / `.env` documentation patterns with only ellipsis placeholders (no live secrets), and the 'shell backtick execution' hits are Markdown code fences and JavaScript template literals. One low-severity semantic note flags a troubleshooting suggestion to disable TLS certificate verification, which is clearly framed as a legacy fallback with a secure alternative offered alongside it.

This is a legitimate, Prisma-authored documentation skill guiding a Prisma ORM v6-to-v7 migration; it contains only Markdown prose and illustrative code snippets, no executable install scripts. All 268 static findings were adjudicated as false positives: the 'path traversal' hits are standard `../generated/prisma` generator output/import paths, the env_access and sensitive hits are ordinary `process.env.DATABASE_URL` / `dotenv` / `.env` documentation patterns with only ellipsis placeholders (no live secrets), and the 'shell backtick execution' hits are Markdown code fences and JavaScript template literals. One low-severity semantic note flags a troubleshooting suggestion to disable TLS certificate verification, which is clearly framed as a legacy fallback with a secure alternative offered alongside it.

This is a legitimate, Prisma-authored documentation skill guiding a Prisma ORM v6-to-v7 migration; it contains only Markdown prose and illustrative code snippets, no executable install scripts. All 268 static findings were adjudicated as false positives: the 'path traversal' hits are standard `../generated/prisma` generator output/import paths, the env_access and sensitive hits are ordinary `process.env.DATABASE_URL` / `dotenv` / `.env` documentation patterns with only ellipsis placeholders (no live secrets), and the 'shell backtick execution' hits are Markdown code fences and JavaScript template literals. One low-severity semantic note flags a troubleshooting suggestion to disable TLS certificate verification, which is clearly framed as a legacy fallback with a secure alternative offered alongside it.