Prisma Migrate Guard

Preflight Prisma migration state before deploy; fails fast on drift, failed migrations, missing DB URLs, or unapplied migration files.

Security Scan

The skill's requirements and behavior match its stated purpose: it runs a read-only Prisma status check using npx/prisma and fails CI on problematic migration states; no unexplained credential access or hidden endpoints were found.

Purpose & Capability

Name/description match the observed behavior. Declared required binaries (bash, node, npx) are justified by the script (it invokes npx prisma). No unrelated credentials, config paths, or extra binaries are requested.

Instruction Scope

SKILL.md simply instructs running the included bash script. The script only reads the Prisma schema file, inspects a DB URL env var (default DATABASE_URL) and runs `npx prisma migrate status`. This will connect to the target database (expected for the purpose). It prints Prisma output and inspects it for failure/drift/unapplied migrations. Note: printing the status output may reveal diagnostic text from Prisma/DB in CI logs.

Install Mechanism

There is no install spec (instruction-only), so nothing is written at install time. However, at runtime the script uses `npx --yes prisma` — if Prisma is not installed locally, npx may fetch and execute the Prisma package from the npm registry. That is expected for using npx but is a runtime download risk to be aware of.

Credentials

The guard purposely depends on a DB connection environment variable (default DATABASE_URL) and optional overrides documented in SKILL.md. Asking for access to this secret is proportionate to the task, but be aware the script reads that env var and uses it to connect to the DB; ensure the CI/agent environment is the correct (non-sensitive) target and that you accept Prisma connecting to the DB.

Persistence & Privilege

The skill does not request persistent presence (always is false), does not modify other skills or system-wide config, and does not write persistent credentials or enable itself. Autonomous invocation is allowed by default but not combined with other concerning factors.

Assessment

This skill appears coherent and suitable for CI preflight checks. Before installing: 1) Confirm your CI environment has the intended DATABASE_URL (or set PRISMA_MIGRATE_DB_URL_ENV) so the guard points to the correct DB (avoid accidentally checking a production DB unless intended). 2) Note the script will run `npx prisma migrate status` — if Prisma isn't installed locally, npx will fetch the package from the npm registry at runtime; ensure your environment policy allows that. 3) Be aware the script prints Prisma output to stdout/stderr (may include diagnostics), so avoid running it in contexts where you don't want that information logged. If those conditions are acceptable, the skill is consistent with its stated purpose.

Use this skill before deploys or CI release steps to verify Prisma migrations are healthy and ready to apply.

What this skill does

• Verifies required Prisma CLI/runtime tools are available
• Validates migration DB URL inputs (DATABASE_URL by default)
• Runs prisma migrate status against a target schema
• Fails on common dangerous states:
  • failed migrations
  • migration drift warnings
  • unapplied migration files
  • missing migration history table hints
• Exits non-zero for CI/deploy gating

Inputs

• Optional env vars:
  • PRISMA_SCHEMA_PATH (default: prisma/schema.prisma)
  • PRISMA_MIGRATE_DB_URL_ENV (default: DATABASE_URL)
  • PRISMA_MIGRATE_GUARD_ALLOW_UNAPPLIED (1 to warn instead of fail)
  • PRISMA_MIGRATE_GUARD_ALLOW_DRIFT (1 to warn instead of fail)

Run

bash scripts/check-prisma-migrate.sh

With explicit schema and env key:

PRISMA_SCHEMA_PATH=apps/api/prisma/schema.prisma \
PRISMA_MIGRATE_DB_URL_ENV=POSTGRES_PRISMA_URL \
bash scripts/check-prisma-migrate.sh

Output contract

• Prints a concise PASS/FAIL report
• Exit code 0 on healthy status
• Exit code 1 on blocking migration issues

Notes

• This guard is read-only (migrate status), it does not apply migrations.
• Keep it in CI before deploy or startup migration steps.