convex-explain-app
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is restricted to read-only operations focused on code analysis. It provides a structured workflow for the agent to describe a project's data model, function surface, and authentication logic without executing code or changing files.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection because it ingests untrusted data from a project's source code (e.g., comments in
schema.ts). However, the risk is mitigated by the skill's strict instructions to remain descriptive and the implementation of a 'read-only' constraint, preventing the agent from taking harmful actions even if influenced by embedded instructions. - [DATA_EXPOSURE]: The skill accesses project configuration files such as
auth.config.ts. This is necessary for its primary purpose of explaining the application's authentication model. No patterns for credential exfiltration or unauthorized network communication were detected. - [COMMAND_EXECUTION]: No shell commands, subprocess spawns, or dangerous system calls are included in the skill's instructions.
Audit Metadata