etch
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute database maintenance commands via a local Java executable (
java -jar convex.jar). These commands perform operations such as integrity validation (validate), garbage collection (gc), and data migration (migrate) on local database files. - [DATA_EXFILTRATION]: The skill provides instructions for reading and exporting database content (
etch read,etch dump). While these operations access potentially sensitive data stored in the database, they are documented as standard administrative tasks for store maintenance and diagnosis. The skill also handles sensitive encryption parameters such as key aliases and passwords (--etch-key,--etch-keypass), which are required for managing encrypted stores (Etch v3). These operations are local to the user's environment and do not involve unauthorized network transmission.
Audit Metadata