Prisma Schema Analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Prisma schema review helper, with one dependency-hygiene caution around an unpinned Prisma CLI command.

Before using the migration-diff step, prefer running Prisma from a locally installed, lockfile-controlled project dependency, or use a local-only invocation so npx does not unexpectedly download code. Run it with ordinary project permissions and avoid exposing unnecessary production credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:86

Finding

Unpinned Prisma CLI May Be Downloaded and Executed by npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:86
Vulnerability Type: Supply-chain exposure through unpinned dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

npx prisma migrate diff --from-schema-datamodel prisma/schema.prisma --to-schema-datasource prisma/schema.prisma --script 2>/dev/null

Technical Analysis

The skill directs the agent to execute npx prisma without specifying a package version or requiring a locally installed, lockfile-pinned Prisma CLI. Depending on the environment and npx behavior, if the package is unavailable locally, npx may resolve, download, and execute it from the configured package registry.

This introduces a supply-chain trust boundary into an otherwise local schema-analysis workflow. The effective executable may differ between audit runs, and its integrity is not established by the skill. Exploitation would require control over or compromise of the relevant package-distribution path, such as the configured registry, package publication, dependency resolution, or network path.

Attack Path

1. A user invokes the Prisma schema analyzer and migration-safety workflow.
2. The agent runs the documented npx prisma migrate diff command.
3. The environment does not contain a suitable local Prisma executable.
4. npx resolves the unpinned package through the configured package registry.
5. A compromised, substituted, or unexpectedly changed package is downloaded.
6. Package installation hooks or CLI code execute with the permissions of the agent or user running the audit.

Impact Assessment

Successfully substituted package code could execute arbitrary commands with the invoking process's privileges. Its accessible scope could include project files, environment variables, credentials available to the process, network resources, and any other resources permitted to that user account.

The skill itself does not request elevated privile ...[truncated 254 chars]

Remediation

View remediation

Remediation Suggestions

• Require Prisma to be declared at an exact or appropriately constrained version in the project's package manifest and resolved through a committed lockfile.

• Prevent implicit downloads by invoking the existing local dependency with:

  bash

  npx --no-install prisma migrate diff \
    --from-schema-datamodel prisma/schema.prisma \
    --to-schema-datasource prisma/schema.prisma \
    --script
  

• Alternatively, use the package manager's local-only execution mechanism and fail safely when Prisma is not installed.

• Install dependencies in a separate controlled step using lockfile-enforcing options such as npm ci.

• Use a trusted registry and apply available package-integrity and provenance verification.

• Run schema analysis in a least-privileged, sandboxed environment without unnecessary credentials or write access.

• Avoid suppressing all standard error output during security-sensitive dependency resolution; preserve diagnostic output so missing local dependencies and resolution failures remain visible.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill invokes npx prisma without pinning an exact package version, which can cause execution of whatever Prisma CLI version is resolved at runtime. In an agent context, this creates supply-chain and reproducibility risk: a compromised, unexpected, or newly released package version could be fetched and executed, potentially running arbitrary code during analysis.

Content

No source excerpt is available for this finding.