Prisma Migrate Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its deploy check can automatically run an unpinned Prisma package in a sensitive CI/database environment.

Review before installing in CI or production deploy workflows. Prefer a pinned Prisma dependency installed from a lockfile and invoke the local binary, or require npx to use an already-installed package, especially when DATABASE_URL or other deployment secrets are present.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/check-prisma-migrate.sh:34

Finding

Unpinned Prisma Package Download and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: scripts/check-prisma-migrate.sh, line 34
Vulnerability Type: Supply-chain risk caused by automatic execution of an unpinned dependency
Risk Level: Medium

Vulnerable Code:

bash

STATUS_OUTPUT=""
if ! STATUS_OUTPUT="$(npx --yes prisma migrate status --schema "$SCHEMA_PATH" 2>&1)"; then
  echo "$STATUS_OUTPUT"
  fail "prisma migrate status failed"
fi

Technical Analysis

The script invokes npx --yes prisma without specifying a reviewed package version or requiring a lockfile-installed local binary. If Prisma is not already installed locally, npx --yes may automatically retrieve and execute the package resolved through the active npm registry and npm configuration.

This makes the code executed by the guard dependent on mutable external package resolution rather than solely on the audited project contents. The effective executable can change after this Skill has been reviewed. A compromised registry, malicious package release, altered npm registry configuration, or dependency-resolution attack could therefore cause attacker-controlled package lifecycle or runtime code to execute.

The command is run during a deployment or CI preflight check, where the process is expected to have access to the selected database URL environment variable and potentially other deployment credentials.

Attack Path

1. An attacker compromises or influences the npm registry, Prisma package release, or npm configuration used by the CI/deployment environment.
2. The expected local Prisma executable is absent, causing npx to resolve the package remotely.
3. The migration guard executes npx --yes prisma migrate status without a pinned version or interactive confirmation.
4. npx downloads and executes the attacker-influenced package.
5. Malicious package code runs with the permissions, environment variables, network access, and filesystem access of the CI or deployment ac ...[truncated 902 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare a reviewed, exact Prisma version in the project dependencies and commit the associated lockfile.
2. Install dependencies in CI using an immutable or frozen-lockfile mode, such as npm ci.
3. Invoke the lockfile-installed binary directly:

   bash

   ./node_modules/.bin/prisma migrate status --schema "$SCHEMA_PATH"
   

4. Alternatively, use npx --no-install prisma ... where supported so execution fails instead of downloading a missing package.
5. Configure an approved npm registry and enforce package integrity and provenance controls.
6. Run the guard under a least-privileged account with access only to the database and files required for migration-status inspection.
7. Limit secrets exposed to the CI step and restrict unnecessary outbound network access after dependencies have been installed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

npx --yes prisma migrate status may download and execute the latest prisma package if it is not already available locally, without a pinned version. In a deploy preflight context, this creates a supply-chain risk: an unexpected or compromised package version could run arbitrary code with the CI runner's privileges and access to sensitive environment variables such as DATABASE_URL.

Content

No source excerpt is available for this finding.