Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Prisma Database Setup Skill Security Audit

What the author says it does (original text)

Guides for configuring Prisma with different database providers (PostgreSQL, MySQL, SQLite, MongoDB, etc.). Use when setting up a new project, changing databases, or troubleshooting connection issues. Triggers on "configure postgres", "connect to mysql", "setup mongodb", "sqlite setup".

Independent security check

Security risks found

Files checked
9
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Low risk

Unpinned npm installs execute whichever third-party package versions resolve at the time

Source references: 4
What we found

The guide installs `prisma`, `@prisma/client`, and driver packages without versions, then runs the Prisma CLI. The resolved releases depend on the registry and lockfile state, and package lifecycle scripts or the CLI execute package code in the development environment.

Why this matters

If a dependency release is compromised, an unexpected version resolves, or the project lacks a controlled lockfile, third-party code could read files and environment variables available to the process or modify project files. The evidence does not show that these packages are currently malicious.

The guide directs installation of several unpinned npm packages and then runs the installed Prisma CLI. Dependency installation and CLI execution trust whatever third-party code resolves at that time. This is a normal, authorized database-setup workflow, but version drift is a real risk. Users can request tested version ranges, a lockfile, and lifecycle-script review guidance.

references/prisma-client-setup.md:5In the instructionsOpen original file
## 1. Install dependencies```bashnpm install prisma --save-devnpm install @prisma/client```
Show 3 other places
references/prisma-client-setup.md:25In the instructionsOpen original file
## 3. Generate Prisma Client```bashnpx prisma generate```Re-run `prisma generate` after every schema change to keep the client in sync.
references/sqlite.md:78In the instructionsOpen original file
For edge compatibility or Turso:1. Install:   ```bash   npm install @prisma/adapter-libsql @libsql/client   ```
references/postgresql.md:65In the instructionsOpen original file
1. Install adapter and driver:   ```bash   npm install @prisma/adapter-pg pg   ```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

MongoDB `db push` changes indexes and constraints on the connected target

Source references: 2
What we found

The guide expressly says to use `prisma db push` to synchronize indexes and constraints, without limiting that instruction to a development database, confirming the connection target, or requiring a backup. This is not a read-only check.

Why this matters

If `DATABASE_URL` points to production or the wrong cluster, the command changes structural rules on that database and may affect write validation, uniqueness, and application behavior.

This is an active MongoDB instruction: `db push` synchronizes model definitions to the database selected by `DATABASE_URL` and can change indexes and constraints. It fits the setup purpose, but the cited section does not require target confirmation or a backup. If the variable points to production by mistake, that environment is affected. Users can restrict it to development and require the target to be shown first.

references/mongodb.md:66In the instructionsOpen original file
## Migrations vs Introspection- **No Migrations**: MongoDB is schema-less. `prisma migrate` commands **do not work**.- **db push**: Use `prisma db push` to sync indexes and constraints.- **db pull**: Use `prisma db pull` to generate schema from existing data (sampling).
Show 1 other places
references/mongodb.md:20In the instructionsOpen original file
```prismadatasource db {  provider = "mongodb"  url      = env("DATABASE_URL")}
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

SQL Server examples disable server-certificate validation

Source references: 4
What we found

Both the connection-string and adapter examples set `trustServerCertificate=true`. Although the text describes this as suitable for local self-signed certificates, the examples can be copied directly into shared, cloud, or production configuration.

Why this matters

On an untrusted network or outside local development, the client may accept a certificate from an impersonated SQL Server, exposing database credentials and query data to interception or alteration.

Legitimate use of this code

The example does trust the server certificate, but its target is explicitly `localhost`, and the text limits the option to self-signed certificates in local development. The shown source does not support use in shared, cloud, or production environments. If adapting it to a remote environment, users should require a verifiable certificate and disable this option.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/sqlserver.md:40In the instructionsOpen original file
## 3. Environment VariableIn `.env`:```envDATABASE_URL="sqlserver://localhost:1433;database=mydb;user=sa;password=Password123;encrypt=true;trustServerCertificate=true"```### Connection String Format```sqlserver://HOST:PORT;database=DB;user=USER;password=PASS;encrypt=true;trustServerCertificate=true```- **encrypt**: Required for Azure (true).- **trustServerCertificate**: True for self-signed certs (local dev).
Show 3 other places
references/sqlserver.md:72In the instructionsOpen original file
   const adapter = new PrismaMssql({     server: 'localhost',     port: 1433,     database: 'mydb',     user: process.env.SQLSERVER_USER,     password: process.env.SQLSERVER_PASSWORD,     options: {       encrypt: true,       trustServerCertificate: true,     },   })
references/sqlserver.md:44In the instructionsOpen original file
```envDATABASE_URL="sqlserver://localhost:1433;database=mydb;user=sa;password=Password123;encrypt=true;trustServerCertificate=true"```
references/sqlserver.md:54In the instructionsOpen original file
- **encrypt**: Required for Azure (true).- **trustServerCertificate**: True for self-signed certs (local dev).
Low risk

The install command does not pin a dependency version

Source references: 5
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

This install step does not specify a `prisma` version, so the resolved code may vary with the npm registry and lockfile state. It is a normal operation for the stated Prisma setup, not evidence of malice; users can ask for a tested version range and retain or review the lockfile.

The `@prisma/client` install is also unpinned, so later runs may resolve a different release and dependency tree. Installation fits the skill’s purpose, but it changes project dependencies and introduces third-party code; users can request a compatible version range and lockfile.

What this evidence establishes

`npx prisma generate` has no version argument, but the preceding step directs installation of a local `prisma` dependency. When present, npx normally runs that version; when absent, it may offer to download another version. The source does not show lockfile state or actual resolution, so this line alone does not establish an unpinned install.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:95In the instructionsOpen original file
   ```bash   npm install prisma --save-dev   npm install @prisma/client
Show 4 other places
SKILL.md:93In the instructionsOpen original file
1. Install Prisma CLI and Prisma Client:   ```bash   npm install prisma --save-dev   npm install @prisma/client   ```
SKILL.md:96In the instructionsOpen original file
   npm install prisma --save-dev   npm install @prisma/client   ```
SKILL.md:109In the instructionsOpen original file
   ```bash   npx prisma generate   ```
SKILL.md:107In the instructionsOpen original file
1. Generate Prisma Client:   ```bash   npx prisma generate   ```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

The managed-database command changes an external Prisma account and writes a local credential file

Source references: 2
What we found

`prisma init --db` is not merely local initialization: the guide states that it logs into Prisma Data Platform, creates a project and database instance, and updates `.env`.

Why this matters

If an agent runs it without confirming the account and organization, it may leave cloud resources in the wrong Prisma account or consume organizational quota; the written connection string also becomes a sensitive local credential.

The command explicitly initiates an external account login, creates a Prisma project and managed database, and writes the connection string to local `.env`. These effects are clearly disclosed and fit managed-database setup, but they still alter the user’s account, may create billable resources, and store a credential on disk. Users can confirm the account and billing terms and ensure `.env` is excluded from version control.

references/prisma-postgres.md:9In the instructionsOpen original file
## Setup via CLIYou can provision a Prisma Postgres instance directly via the CLI:```bashprisma init --db```This will:1. Log you into Prisma Data Platform.2. Create a new project and database instance.3. Update your `.env` with the connection string.
Show 1 other places
references/prisma-postgres.md:17In the instructionsOpen original file
This will:1. Log you into Prisma Data Platform.2. Create a new project and database instance.3. Update your `.env` with the connection string.

Inside this skill

8 instruction sections

This Skill is a configuration guide. It directs an agent to modify Prisma schema/config files, set environment variables containing database credentials, and install, generate, and instantiate Prisma Client.

View source
SKILL.md:55In the instructionsOpen original file
Your configuration shape depends on the provider and Prisma major version:1. **All providers** use **`prisma/schema.prisma`**.2. **Prisma 7 SQL setups** typically use **`prisma.config.ts`** for datasource URLs.3. **MongoDB projects should stay on Prisma 6.x**, keep `url = env("DATABASE_URL")` in the schema, and continue using the classic MongoDB setup.## Driver AdaptersThe standard SQL workflow uses a driver adapter. Choose the adapter and driver for your database and pass the adapter to `PrismaClient`.
SKILL.md:89In the instructionsOpen original file
## Prisma Client Setup (Required)Prisma Client must be installed and generated for any database.1. Install Prisma CLI and Prisma Client:   ```bash   npm install prisma --save-dev   npm install @prisma/client   ```1. Add a generator block (`prisma-client` requires an explicit output path):   ```prisma   generator client {     provider = "prisma-client"     output   = "../generated"   }   ```1. Generate Prisma Client:   ```bash   npx prisma generate   ```

SQL database connections are passed from runtime environment variables to provider-specific driver adapters; the SQLite/Turso path also reads a remote database URL and authentication token.

View source
references/postgresql.md:70In the instructionsOpen original file
2. Instantiate Prisma Client with the adapter:   ```typescript   import 'dotenv/config'   import { PrismaClient } from '../generated/client'   import { PrismaPg } from '@prisma/adapter-pg'   const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })   const prisma = new PrismaClient({ adapter })   ```
references/sqlite.md:85In the instructionsOpen original file
2. Instantiate:   ```typescript   import { PrismaClient } from '../generated/client'   import { PrismaLibSql } from '@prisma/adapter-libsql'   const adapter = new PrismaLibSql({     url: process.env.TURSO_DATABASE_URL,     authToken: process.env.TURSO_AUTH_TOKEN,   })   const prisma = new PrismaClient({ adapter })   ```

MongoDB is separately kept on Prisma 6.x with `prisma-client-js`; the documentation explicitly excludes Prisma 7's SQL-adapter workflow.

View source
references/mongodb.md:3In the instructionsOpen original file
MongoDB projects should stay on the latest Prisma 6.x release. Do not upgrade a MongoDB app to Prisma 7's SQL client path.## Prerequisites- MongoDB 4.2+- Replica Set configured (required for transactions)- Latest Prisma 6.x release, or your team's pinned Prisma 6 version- Node.js 20.19.0+- TypeScript 5.4.0+## 1. Schema ConfigurationUse the standard Prisma 6 MongoDB setup with `prisma-client-js`.
references/mongodb.md:30In the instructionsOpen original file
### Driver AdaptersDo **not** apply the Prisma 7 SQL adapter setup here. MongoDB does not use a SQL `@prisma/adapter-*` package.

The optional managed Prisma Postgres CLI flow logs into an external platform, creates a project and database, and writes the connection string into the local `.env` file.

View source
references/prisma-postgres.md:9In the instructionsOpen original file
## Setup via CLIYou can provision a Prisma Postgres instance directly via the CLI:```bashprisma init --db```This will:1. Log you into Prisma Data Platform.2. Create a new project and database instance.3. Update your `.env` with the connection string.
Start here · InstructionsSKILL.md
prisma-database-setup
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.

File reference map

References: 9
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records9 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/cockroachdb.mdFull text included
  • references/mongodb.mdFull text included
  • references/mysql.mdFull text included
  • references/postgresql.mdFull text included
  • references/prisma-client-setup.mdFull text included
  • references/prisma-postgres.mdFull text included
  • references/sqlite.mdFull text included
  • references/sqlserver.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/cockroachdb.mdSupporting file
  • references/mongodb.mdSupporting file
  • references/mysql.mdSupporting file
  • references/postgresql.mdSupporting file
  • references/prisma-client-setup.mdSupporting file
  • references/prisma-postgres.mdSupporting file
  • references/sqlite.mdSupporting file
  • references/sqlserver.mdSupporting file

Operations mentioned in code and instructions

Read keys or account settings
SKILL.md:85In the instructionsOpen original file
const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })const prisma = new PrismaClient({ adapter })
SKILL.md:117In the instructionsOpen original file
   const adapter = new PrismaPg({ connectionString: process.env.DATABASE_URL })   const prisma = new PrismaClient({ adapter })
references/cockroachdb.md:41In the instructionsOpen original file
In `.env`:
Run commands
SKILL.md:94In the instructionsOpen original file
1. Install Prisma CLI and Prisma Client:   ```bash   npm install prisma --save-dev
SKILL.md:108In the instructionsOpen original file
1. Generate Prisma Client:   ```bash   npx prisma generate
references/cockroachdb.md:54In the instructionsOpen original file
1. Install adapter and driver:   ```bash   npm install @prisma/adapter-pg pg
Install extra software packages
SKILL.md:95In the instructionsOpen original file
   ```bash   npm install prisma --save-dev   npm install @prisma/client
SKILL.md:96In the instructionsOpen original file
   npm install prisma --save-dev   npm install @prisma/client   ```
SKILL.md:109In the instructionsOpen original file
   ```bash   npx prisma generate   ```
Lines read
975
File checksum (to compare versions)
dccef9cf86b64f2c0907c5b6223b254f8c00e33b2978e7c5c53a17f4fbc51b68