turborepo
No security findings. Scanned 1 time, most recently 2026-02-08.
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines, creates packages, sets up monorepo, shares code between apps, runs changed/affected packages, debugs cache, or has apps/packages directories.
- Package
- 26 files, 112 KB
- SKILL.md
- 3185 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Turborepo Skill · IMPORTANT: Package Tasks, Not Root Tasks · Secondary Rule: `turbo run` vs `turbo` · CI workflows - ALWAYS "turbo run" · Quick Decision Trees · "I need to configure a task" · "My cache isn't working" · "I want to run only changed packages" · "I want to filter packages" · "Environment variables aren't working" · "I need to set up CI" · "I want to watch for changes during development"
Findings
No findings. SAFE
What is in the package
26 files, 112 KB. Show the list.
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 27 KB |
command/turborepo.md | doc | 2.5 KB |
references/best-practices/RULE.md | doc | 4.8 KB |
references/best-practices/dependencies.md | doc | 4.2 KB |
references/best-practices/packages.md | doc | 6.2 KB |
references/best-practices/structure.md | doc | 4.9 KB |
references/boundaries/RULE.md | doc | 1.9 KB |
references/caching/RULE.md | doc | 2.2 KB |
references/caching/gotchas.md | doc | 2.8 KB |
references/caching/remote-cache.md | doc | 2.5 KB |
references/ci/RULE.md | doc | 2.1 KB |
references/ci/github-actions.md | doc | 2.7 KB |
references/ci/patterns.md | doc | 2.5 KB |
references/ci/vercel.md | doc | 2.1 KB |
references/cli/RULE.md | doc | 2.1 KB |
references/cli/commands.md | doc | 5.4 KB |
references/configuration/RULE.md | doc | 4.2 KB |
references/configuration/global-options.md | doc | 4.1 KB |
references/configuration/gotchas.md | doc | 7.9 KB |
references/configuration/tasks.md | doc | 5.3 KB |
references/environment/RULE.md | doc | 1.7 KB |
references/environment/gotchas.md | doc | 2.9 KB |
references/environment/modes.md | doc | 2.4 KB |
references/filtering/RULE.md | doc | 4.1 KB |
references/filtering/patterns.md | doc | 2.4 KB |
references/watch/RULE.md | doc | 1.9 KB |
External hosts referenced
turborepo.dev vercel.com github.com your-cache-server.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
API_URL TURBO_TEAM TURBO_TOKEN API_KEY DATABASE_URL GITHUB_BASE_REF MY_API_KEY MY_API_URL TURBO_REMOTE_CACHE_SIGNATURE_KEY
Package contents recorded 2026-10-22 at commit a7b53c133e33. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/vercel/turborepo
- Raw scan result: turborepo-scan.json
- Badge for your README:
- Request a re-scan