convex-launch-readiness
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources like deployment logs and code identifiers, which could contain malicious instructions designed to alter the agent's audit findings or fix recommendations.
- Ingestion points: The workflow in
SKILL.md(Steps 2 and 3) describes gathering data from deployment logs viaconvex-insightsand live traffic evidence viaconvex-advisor. - Boundary markers: The skill utilizes structured schemas (
specs/finding.schema.jsonandspecs/finding-report.schema.json) to organize findings, which provides structural boundaries but does not necessarily sanitize the content within data fields. - Capability inventory: The skill has access to code analysis tools, deployment metrics, and logs, and it possesses the ability to dispatch instructions to other "fixer" capabilities as mentioned in
SKILL.md(Step 6). - Sanitization: There is no explicit description of sanitization or filtering of log data or code identifiers before they are processed and presented in the final readiness report.
Audit Metadata