convex-design

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run npx tsc --noEmit and npx convex dev --once to verify backend code. These are standard developer operations within the Convex ecosystem.- [INDIRECT_PROMPT_INJECTION]: The skill processes natural language product descriptions from users to generate and verify code, creating an attack surface for indirect instructions. Ingestion points: user's plain-English product ideas mentioned in SKILL.md. Boundary markers: no explicit delimiters or 'ignore' instructions are defined for processing user input. Capability inventory: the skill can write files to the convex/ directory and execute shell commands via npx. Sanitization: no explicit sanitization or validation of the generated code is described before execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 01:02 AM