Prisma Schema Analyzer

• Risk level: Low
• Analyzed: May 1, 2026, 10:46 AM
• Findings: 3
• Version: 1.0.0

Overview

This instruction-only skill appears aligned with reviewing Prisma schemas, with only normal cautions about reading local project files and optionally running Prisma CLI commands.

This skill is reasonable to use for Prisma review. Before installing or invoking it, be comfortable with the agent reading schema.prisma, migrations, and relevant source code, and verify any npx/prisma command and database target before allowing execution.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

The agent may inspect local project files to produce the schema review.

Why it was flagged

The skill documents shell commands for reading local Prisma schema and migration files. This is expected for the stated analysis purpose and is not destructive, but it does involve local project inspection.

Skill content

cat prisma/schema.prisma 2>/dev/null
find . -name "schema.prisma" 2>/dev/null
ls prisma/migrations/ 2>/dev/null | tail -10

Recommendation

Run it only in the intended repository and review any shell command before execution.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

If the Prisma CLI is not already installed locally, command behavior may depend on external package resolution.

Why it was flagged

The skill references running Prisma through npx, while the package has no install spec. This is purpose-aligned, but npx may depend on the local project setup or fetch/use a CLI outside the reviewed artifact.

Skill content

npx prisma migrate diff --from-schema-datamodel prisma/schema.prisma --to-schema-datasource prisma/schema.prisma --script 2>/dev/null

Recommendation

Prefer using the project-pinned Prisma CLI version, such as through an existing package-lock or pnpm/yarn lockfile, and avoid unexpected package downloads.

ASI03: Identity and Privilege Abuse

Note

What this means

The command may interact with the database environment configured for the project, likely to inspect schema state.

Why it was flagged

The migration-diff example explicitly compares against the Prisma schema datasource, which may use the database connection configured by the project. This is relevant to migration safety and no credentials are requested or embedded.

Skill content

--to-schema-datasource prisma/schema.prisma

Recommendation

Confirm the DATABASE_URL or Prisma datasource target before running migration-diff commands, especially in production environments.