convex-cleanup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill reads bearer authentication tokens from
~/.convex/config.json. This sensitive file contains credentials required for interacting with the Convex cloud platform.\n- [COMMAND_EXECUTION]: The skill executesgit status,git worktree list, andgh pr listcommands to inventory local work and remote pull request states.\n- [EXTERNAL_DOWNLOADS]: The skill communicates with the official Convex Management API athttps://api.convex.dev/v1. Convex is a well-known service, and the network activity is consistent with the skill's management purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes pull request lists and repository files, which can contain untrusted content from external contributors.\n - Ingestion points: Pull request metadata via
gh pr listand local documentation files likeAGENTS.md.\n - Boundary markers: The skill instructions do not specify delimiting or escaping the output of the CLI tools.\n
- Capability inventory: The agent has the ability to delete cloud deployments and execute shell commands based on the analyzed data.\n
- Sanitization: No explicit sanitization or validation of pull request names or repository file content is performed before processing.
Audit Metadata