turborepo
Provides guidance for configuring and optimizing Turborepo monorepo build systems, enhancing task management and CI workflows.
Install this skill
Security score
The turborepo skill was audited on Feb 25, 2026 and we found 26 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Access to .env file
| 156 | ├─ .env changes not causing rebuilds → .env not in `inputs` |
Access to .env file
| 346 | "globalDependencies": ["**/.env.*local"] |
Access to .env file
| 351 | "globalDependencies": [".env"], |
Access to .env file
| 354 | "inputs": ["$TURBO_DEFAULT$", ".env*"], |
Access to .env file
| 371 | "inputs": ["$TURBO_DEFAULT$", ".env*"] |
Access to .env file
| 375 | "inputs": ["$TURBO_DEFAULT$", ".env*"] |
Access to .env file
| 379 | "inputs": ["$TURBO_DEFAULT$", ".env*"], |
Access to .env file
| 389 | "globalDependencies": [".env*"], |
Access to .env file
| 603 | ### `.env` Files Not in Inputs |
Access to .env file
| 605 | Turbo does NOT load `.env` files - your framework does. But Turbo needs to know about changes: |
Access to .env file
| 608 | // WRONG: .env changes don't invalidate cache |
Access to .env file
| 617 | // CORRECT: .env file changes invalidate cache |
Access to .env file
| 622 | "inputs": ["$TURBO_DEFAULT$", ".env", ".env.*"] |
Access to .env file
| 628 | ### Root `.env` File in Monorepo |
Access to .env file
| 630 | A `.env` file at the repo root is an anti-pattern — even for small monorepos or starter templates. It creates implicit coupling between packages and makes it unclear which packages depend on which var |
Access to .env file
| 633 | // WRONG - root .env affects all packages implicitly |
Access to .env file
| 635 | ├── .env # Which packages use this? |
Access to .env file
| 641 | // CORRECT - .env files in packages that need them |
Access to .env file
| 645 | │ │ └── .env # Clear: web needs DATABASE_URL |
Access to .env file
| 647 | │ └── .env # Clear: api needs API_KEY |
Access to .env file
| 651 | **Problems with root `.env`:** |
Access to .env file
| 655 | - Cache invalidation is coarse-grained (root .env change invalidates everything) |
Access to .env file
| 827 | "globalDependencies": [".env"], |
Access to .env file
| 863 | | [environment/gotchas.md](./references/environment/gotchas.md) | .env files, CI issues | |
External URL reference
| 725 | "$schema": "https://turborepo.dev/schema.v2.json", |
External URL reference
| 914 | - Live: https://turborepo.dev/docs |
Install this skill with one command
/learn @rykuno/turborepo