Most static command and URL findings are Markdown examples or documentation links, not hidden execution or data transfer. Real risk remains in the self-hosted cache sample, which uses user-derived filesystem paths without authentication, and in cache inputs that include environment files. No prompt injection text was found in SKILL.md.
The template instructs Turborepo to include .env as a global dependency, causing secret-bearing files to affect cache keys. This can be legitimate cache invalidation, but it needs explicit secret handling guidance.
.env.local commonly contains developer secrets, and the template includes it as a global cache dependency. In remote cache workflows, this creates secret-handling risk even if raw values are not intentionally published.
The environment variant file .env.local is explicitly listed in cache inputs. That pattern can tie private local secrets to shared cache behavior and should be documented or avoided.
The Express cache server builds paths from teamId and hash values, accepts unauthenticated uploads, and disables remote cache signatures. A copied deployment could allow cache poisoning, unsafe writes, and artifact reads outside the intended team scope.
The code directly joins user-controlled route and query values into filesystem paths, writes request bodies, and sets signature to false. The example also passes a token in the client command, but the server does not validate it.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
createReadStream is called on filePath built from route and query parameters without authentication or canonical path validation. This can expose cache artifacts or unintended files if copied into a service.
createWriteStream writes request bodies to a path derived from user-controlled teamId and hash values. Without validation or authorization, this enables cache poisoning and unsafe filesystem writes.
fs.access checks a user-derived cache path and reveals whether an artifact exists. This supports cache artifact enumeration unless path validation and authorization are added.
Most static command and URL findings are Markdown examples or documentation links, not hidden execution or data transfer. Real risk remains in the self-hosted cache sample, which uses user-derived filesystem paths without authentication, and in cache inputs that include environment files. No prompt injection text was found in SKILL.md.
The template instructs Turborepo to include .env as a global dependency, causing secret-bearing files to affect cache keys. This can be legitimate cache invalidation, but it needs explicit secret handling guidance.
.env.local commonly contains developer secrets, and the template includes it as a global cache dependency. In remote cache workflows, this creates secret-handling risk even if raw values are not intentionally published.
The environment variant file .env.local is explicitly listed in cache inputs. That pattern can tie private local secrets to shared cache behavior and should be documented or avoided.
The Express cache server builds paths from teamId and hash values, accepts unauthenticated uploads, and disables remote cache signatures. A copied deployment could allow cache poisoning, unsafe writes, and artifact reads outside the intended team scope.
The code directly joins user-controlled route and query values into filesystem paths, writes request bodies, and sets signature to false. The example also passes a token in the client command, but the server does not validate it.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
createReadStream is called on filePath built from route and query parameters without authentication or canonical path validation. This can expose cache artifacts or unintended files if copied into a service.
createWriteStream writes request bodies to a path derived from user-controlled teamId and hash values. Without validation or authorization, this enables cache poisoning and unsafe filesystem writes.
fs.access checks a user-derived cache path and reveals whether an artifact exists. This supports cache artifact enumeration unless path validation and authorization are added.
Static analysis reported many command, network, filesystem, environment, and obfuscation patterns, but most are false positives from markdown templates and command examples. The confirmed risks are documentation-level issues in the self-hosted cache example: unvalidated filesystem paths, missing authentication, and disabled remote cache signatures. No prompt injection attempt or confirmed malicious intent was found.
The self-hosted cache example builds file paths from request parameters and query values before reading and writing cache files. A copied implementation should validate teamId and hash values and constrain paths to the cache directory.
The TypeScript example joins CACHE_DIR with request-controlled teamId and hash values before file reads and writes. This is strong evidence of path handling risk in the published template, although the skill itself does not execute the code.
Remote Cache Example Lacks Server-Side Authentication
The cache server example exposes artifact GET, PUT, and HEAD routes without checking a token or team authorization. Users who copy it could publish an unauthenticated cache endpoint.
The client command includes a token placeholder, but the server example has no corresponding token verification. The risk is clear for copied deployments, but it remains documentation-level code.
The self-hosted cache configuration disables remote cache signatures. This can weaken artifact integrity protections if users apply it without compensating controls.
The template explicitly sets signature to false for remote caching. This is a real configuration choice, but the final risk depends on deployment controls outside the skill.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Sensitive Environment Files Included in Cache Inputs
The Turborepo template lists .env and .env.local as global dependencies. This may cause secret-bearing files to influence cache keys, so users should avoid storing secrets in committed cache inputs.
The file references are explicit, and the skill also warns against including secrets in environment values. The risk is limited because there is no evidence of secret exfiltration.
Static Analyzer Code Execution Alerts Are Documentation Examples
The backtick execution, weak cryptography, and critical obfuscation alerts are not confirmed as malicious behavior. The detected locations are markdown fences, shell examples, schema URLs, and cache terminology in a documentation-only skill.
Review found no executable skill scripts, prompt injection, hidden download behavior, or credential exfiltration. The suspicious tokens appear inside explanatory markdown examples.
Pure documentation skill containing only Turborepo configuration templates and best practices. All 55 static findings are FALSE POSITIVES - the scanner incorrectly flagged markdown code block delimiters as shell backticks, cache hash references as cryptographic algorithms, and standard Turborepo config patterns as credential access. No executable code, scripts, or malicious patterns exist in this skill.
Pure documentation skill containing only Turborepo configuration templates and best practices. All 55 static findings are FALSE POSITIVES - the scanner incorrectly flagged markdown code block delimiters as shell backticks, cache hash references as cryptographic algorithms, and standard Turborepo config patterns as credential access. No executable code, scripts, or malicious patterns exist in this skill.
Pure documentation skill containing only Turborepo configuration templates and best practices. No executable code, scripts, network calls, filesystem access, or environment variable reading. Content is entirely instructional markdown aligned with build optimization use case.
4
Files scanned
598
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation skill containing only Turborepo configuration templates and best practices. No executable code, scripts, network calls, filesystem access, or environment variable reading. Content is entirely instructional markdown aligned with build optimization use case.
4
Files scanned
598
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.