convex-auth

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses npx and node to perform standard setup tasks. This includes setting environment variables via the Convex CLI and adding UI components via the shadcn CLI.
  • [DYNAMIC_EXECUTION]: A specific Node.js script is executed to generate RSA keys for JWT signing. This script runs locally using the jose library and is not constructed from external input.
  • [EXTERNAL_DOWNLOADS]: Installs the @convex-dev/auth and jose packages. These are official or well-known libraries relevant to the skill's purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill reads existing application configuration files (such as convex.config.ts) to determine the current state.
  • Ingestion points: Reads local application source files (e.g., convex.config.ts, convex/auth.ts).
  • Boundary markers: Not explicitly defined in the instructions.
  • Capability inventory: Performs file writes, shell command execution (npx, node), and package installation across SKILL.md.
  • Sanitization: Relies on the agent's internal logic for processing file content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 01:00 AM