Skillv1.0.0

ClawScan security

Turborepo Monorepo Patterns · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 27, 2026, 2:22 AM

Verdict: suspicious
Confidence: high
Model: gpt-5-mini
Summary: The skill is a coherent Turborepo guide, but its runtime instructions and included CI examples reference several secrets and environment variables (tokens, deploy secrets, and DB-related commands) while the skill metadata declares no required environment variables — this mismatch is a notable risk and should be clarified before use.
Guidance: This skill is a legitimate-looking Turborepo guide, but it references several secrets and operations that have side effects (remote cache tokens, Vercel deploy tokens, and Prisma DB commands). Before installing or invoking it: 1) Treat the CI and CLI examples as templates — do not paste production secrets into the agent environment without reviewing who/what will run them. 2) Expect that to run deploy or DB-migration commands you will need tokens/DB credentials; the skill's metadata does not declare these, so verify where you store secrets and ensure least privilege. 3) Review the included .github/workflows/ci.yml and any prisma migration steps; run in a safe/non-production environment first. 4) If you plan to use this skill programmatically, request that the skill author explicitly declare required env vars (TURBO_TOKEN, TURBO_TEAM, VERCEL_* and any DB connection strings) so you can audit and supply least-privilege secrets. If you cannot confirm those declarations, avoid giving the agent secrets or running commands that perform deploys or DB migrations.

Review Dimensions

Purpose & Capability: okThe name and description (Turborepo monorepo patterns) match the included content: workspace config, turbo.json examples, shared package patterns, and GitHub Actions CI. The files and examples are appropriate for the stated purpose.
Instruction Scope: concernSKILL.md and the referenced CI workflow instruct running commands that may use/require secrets and affect external services: remote caching (turbo login/link, turbo --api with --token), GitHub Actions YAML that expects TURBO_TOKEN/TURBO_TEAM and Vercel deploy steps using VERCEL_TOKEN/ORG/PROJECT. The guide also includes database migration/generation commands (prisma db push/migrate) which may require database connection credentials. The instructions do not overstep by reading arbitrary host files, but they do direct potentially destructive or externally-visible actions (deploys, DB migrations) if run with credentials.
Install Mechanism: okInstruction-only skill with no install spec and no code files; nothing is downloaded or written by the skill itself. This is the lowest-risk install mechanism.
Credentials: concernThe metadata lists no required environment variables, yet the documentation and CI examples reference multiple tokens/secrets (TURBO_TOKEN, TURBO_TEAM, VERCEL_TOKEN, VERCEL_ORG_ID, VERCEL_PROJECT_ID and implied DB credentials for Prisma). Those env vars are plausible and expected for these operations, but they should be declared in requires.env. The absence of declared env requirements is a mismatch that could lead to accidental credential exposure or accidental execution if users supply secrets without understanding scope.
Persistence & Privilege: okThe skill is not always-enabled, and it does not request persistent system presence or claim to modify other skills or global agent config. Autonomous invocation is allowed (the platform default) but there are no additional privilege escalations requested by the skill.