convex-auth
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxandnodeto perform standard setup tasks. This includes setting environment variables via the Convex CLI and adding UI components via theshadcnCLI. - [DYNAMIC_EXECUTION]: A specific Node.js script is executed to generate RSA keys for JWT signing. This script runs locally using the
joselibrary and is not constructed from external input. - [EXTERNAL_DOWNLOADS]: Installs the
@convex-dev/authandjosepackages. These are official or well-known libraries relevant to the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill reads existing application configuration files (such as
convex.config.ts) to determine the current state. - Ingestion points: Reads local application source files (e.g.,
convex.config.ts,convex/auth.ts). - Boundary markers: Not explicitly defined in the instructions.
- Capability inventory: Performs file writes, shell command execution (
npx,node), and package installation acrossSKILL.md. - Sanitization: Relies on the agent's internal logic for processing file content.
Audit Metadata