技能 prisma-postgres-setup
📦

prisma-postgres-setup

v1.1.0 内容修订 r2 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令

配置 Prisma Postgres 数据库

创建数据库、配置凭据以及准备 Prisma 项目需要多个相互协调的步骤。此技能通过交互式选项和连接验证，引导用户完成 Prisma Postgres 的完整设置流程。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "prisma-postgres-setup" from https://skillstore.io/skills/prisma-prisma-postgres-setup.md and its manifest at https://skillstore.io/api/skills/prisma-prisma-postgres-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/prisma-prisma-postgres-setup.md 已签名 manifest GET /api/skills/prisma-prisma-postgres-setup/manifest 已签名 lockfile GET /api/skills/prisma-prisma-postgres-setup/lockfile

测试它

正在使用“prisma-postgres-setup”。 为我的任务应用程序设置 Prisma Postgres。

预期结果:

  • 显示可用区域以供选择。
  • 确认后创建项目和数据库。
  • 为项目添加 Prisma 7 配置并验证连接。

正在使用“prisma-postgres-setup”。 将我现有的 Node.js 项目连接到新的 Prisma 数据库。

预期结果:

  • 识别所需的依赖项和配置更改。
  • 将直接连接字符串存储在本地环境文件中。
  • 准备迁移就绪的 Prisma 配置。

安全审计

高风险
v10 • 2026/7/23 打开版本化报告

Ten static findings are confirmed: eight executable command spans and two operations involving secret-bearing environment files. Most alerts are Markdown, official Prisma URLs, placeholders, or standard local configuration. Contextual review found unsafe token handling and permanent project deletion, but no prompt injection or unrelated exfiltration.

5
已扫描文件
721
分析行数
8
复核项
0
已忽略误报

已确认安全问题 (5)

高
SKILL.md:53
Environment file access
Check for `PRISMA_SERVICE_TOKEN` in the environment or `.env` file.
The workflow searches .env for a workspace-scoped service token, giving the agent access to a high-impact credential.
高
SKILL.md:138
Environment file access
2. Write the direct connection string to `.env`. **Append** to the file if it already exists — do no
The workflow appends a live database connection credential to a plaintext .env file, creating a secret-storage and file-modification risk.
高
SKILL.md:47-64references/auth.md:31-40
Workspace Service Token Requested Through Chat
The workflow says, "Copy the token and paste it here," placing a workspace-scoped service token in model conversation history. The token grants access to every workspace resource.
The chat request is explicit, and the authentication reference confirms that the token covers every resource in the workspace.
高
SKILL.md:104-108references/endpoints.md:217-223
Permanent Project Deletion in Quota Recovery
When creation reaches the database limit, the workflow deletes the project selected from a menu before retrying. Project deletion permanently removes all databases.
The main workflow directs deletion after selection, and the endpoint reference explicitly states that every project database is permanently deleted.
中
SKILL.md:64-72SKILL.md:83-86
Bearer Token Exposed in Command Arguments
The curl examples expand the bearer token into command arguments. Local process inspection, shell tracing, or command logging can expose the workspace credential.
The examples interpolate the shell variable directly into curl header arguments, which exposes the expanded value to local command observability.
能力复核项 (8)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中
SKILL.md:70-73
Ruby/shell backtick execution
```bash
This fenced Bash span runs curl with a bearer token against Prisma, creating command-line credential exposure and an authenticated network action.
中
SKILL.md:83-92
Ruby/shell backtick execution
```bash
This fenced Bash span performs an authenticated POST that creates remote Prisma resources and expands the bearer token into command arguments.
中
SKILL.md:114-119
Ruby/shell backtick execution
```bash
This fenced Bash span performs an authenticated POST that creates a named database connection and returns a new credential.
中
SKILL.md:127-129
Ruby/shell backtick execution
```bash
The npm install command modifies project dependencies and can execute package lifecycle scripts, so it is real external command execution.
中
SKILL.md:148
Ruby/shell backtick execution
5. If `prisma/schema.prisma` does not exist, run `npx prisma init` to scaffold the project. This cre
The npx command executes the Prisma CLI and writes project files, with possible package download when the binary is unavailable locally.
中
SKILL.md:189-191
Ruby/shell backtick execution
```bash
The migration command executes Prisma tooling, writes migration files, and changes the connected database schema.
中
SKILL.md:195
Ruby/shell backtick execution
Only use `npx prisma db push` if the user explicitly asks for prototyping-only mode (no migration hi
The documented npx commands can push schema changes directly and regenerate client artifacts, causing real local and database modifications.
中
SKILL.md:222-224
Ruby/shell backtick execution
```bash
The npx command executes a generated TypeScript file with database credentials and issues a query against the provisioned database.

风险因素

🌐 网络访问 (17)
references/api-basics.md:54 references/api-basics.md:8 references/auth.md:7 references/auth.md:28 references/endpoints.md:65 references/endpoints.md:71 references/endpoints.md:77 references/endpoints.md:87 references/endpoints.md:132 references/endpoints.md:141 references/endpoints.md:179 references/endpoints.md:192 SKILL.md:32 SKILL.md:72 SKILL.md:84 SKILL.md:115 SKILL.md:239
🔑 环境变量 (23)
references/endpoints.md:111 references/endpoints.md:199 references/prisma7-client.md:22 references/prisma7-client.md:45 references/prisma7-client.md:22 references/prisma7-client.md:45 references/prisma7-client.md:17 references/prisma7-client.md:40 references/prisma7-client.md:22 references/prisma7-client.md:45 SKILL.md:169 SKILL.md:209 SKILL.md:169 SKILL.md:209 SKILL.md:128 SKILL.md:136 SKILL.md:163 SKILL.md:177 SKILL.md:204 SKILL.md:141 SKILL.md:169 SKILL.md:209 SKILL.md:228
⚙️ 外部命令 (50)
SKILL.md:25 SKILL.md:26 SKILL.md:33 SKILL.md:37 SKILL.md:53 SKILL.md:62 SKILL.md:64 SKILL.md:70-73 SKILL.md:73-75 SKILL.md:75 SKILL.md:79-83 SKILL.md:83-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98 SKILL.md:99 SKILL.md:100-102 SKILL.md:102-104 SKILL.md:104 SKILL.md:108-114 SKILL.md:114-119 SKILL.md:119-121 SKILL.md:121-127 SKILL.md:127-129 SKILL.md:129-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136 SKILL.md:138-140 SKILL.md:140-142 SKILL.md:142-144 SKILL.md:144 SKILL.md:146 SKILL.md:148 SKILL.md:150 SKILL.md:152-156 SKILL.md:156-158 SKILL.md:158-160 SKILL.md:160-172 SKILL.md:172-175 SKILL.md:175 SKILL.md:176 SKILL.md:177 SKILL.md:183-184 SKILL.md:184-189 SKILL.md:189-191 SKILL.md:191-193 SKILL.md:193
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/prisma-prisma-postgres-setup/security.svg)](https://skillstore.io/skills/prisma-prisma-postgres-setup?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/prisma-prisma-postgres-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/prisma-prisma-postgres-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/prisma-prisma-postgres-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

prisma. (2026). prisma-postgres-setup security audit report (audit version 10) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10

BibTeX 引用

@techreport{prisma-prisma-prisma-postgres-setup-2026, author = {prisma}, title = {prisma-postgres-setup security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10}, note = {Author version 1.1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "prisma-postgres-setup security audit report (audit version 10)" version: "1.1.0" type: report authors: - name: "prisma" date-released: "2026-07-23" url: "https://skillstore.io/skills/prisma-prisma-postgres-setup/audits/10" identifiers: - type: other value: "skillstore:prisma-prisma-postgres-setup:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
45
架构
100
可维护性
87
内容
65
社区
91
规范符合性

你能构建什么

启动新的应用程序数据库

配置新的 Prisma Postgres 数据库，并连接新的 Node.js 应用程序。

准备本地开发环境

向现有本地项目添加直接数据库连接和 Prisma 7 配置。

标准化团队入职流程

针对项目、区域、迁移和连接检查，遵循可重复执行的设置流程。

试试这些提示

创建我的第一个数据库 
为我的本地项目设置一个新的 Prisma Postgres 数据库。让我选择区域，并解释每个步骤。
连接现有项目 
配置 Prisma Postgres，并为此 Node.js 项目配置 Prisma 7。保留我现有的环境设置。
创建迁移就绪的设置 
创建 Prisma Postgres 项目，配置 prisma.config.ts，并准备迁移工作流。在应用更改之前显示计划中的更改。
验证安全连接 
为此项目配置 Prisma Postgres，确认 Git 已忽略 .env，并在我批准命令后运行连接验证。

最佳实践

  • 使用专用的工作区服务令牌，并且不要在终端输出中打印该令牌。
  • 将 DATABASE_URL 保存在 .env 中，并确认 Git 已忽略 .env。
  • 在创建迁移或推送数据库更改之前审查架构变更。

避免

  • 对于 Prisma 7，不要将连接 URL 直接放入 schema.prisma。
  • 不要在此新的直接连接工作流中使用池化端点或 Accelerate 端点。
  • 未经用户明确选择和确认，不要删除现有项目。

常见问题

需要哪些凭据？
你需要一个有权访问目标工作区的 Prisma Postgres 工作区服务令牌。
它能用于现有数据库吗？
不支持。此技能用于配置新的 Prisma Postgres 数据库并连接本地项目。
它使用哪个连接字符串？
它使用 Management API 返回的 PostgreSQL 直接连接字符串。
连接 URL 在哪里配置？
URL 存储在 .env 中，并通过 prisma.config.ts 为 Prisma 7 加载。
它会创建迁移吗？
在架构经过审查并准备就绪后，它会运行标准的 Prisma 迁移工作流。
它可以改用 Prisma Console 吗？
不能。此工作流使用 Prisma Management API 进行配置，而 Console 用于工作区访问和后续检查。

开发者详情

作者

prisma

许可证

MIT

作者版本

v1.1.0

Skillstore 修订

r2

仓库

https://github.com/prisma/skills/tree/1a9f427e9fe2137298abbcc1a6f372db92e8c40d/prisma-postgres-setup

引用

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

维护新鲜度

2026/7/25

使用量

0 次下载 · 0 次浏览

文件结构

📁 references/

📄 api-basics.md

📄 auth.md

📄 endpoints.md

📄 prisma7-client.md

📄 SKILL.md

prisma 的更多技能

查看全部

相关技能

查看全部