convex-suggest
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access operations were detected in the skill contents.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code snippets and user queries to trigger optimization recommendations. 1. Ingestion points: codeSnippets and userAsk (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Installation of components via the '/add' command (SKILL.md). 4. Sanitization: Absent. The risk of automated obedience is mitigated by a mandatory human-in-the-loop consent model.
- [EXTERNAL_DOWNLOADS]: The skill identifies and recommends various official vendor packages and well-known services (e.g., @convex-dev/workflow, Resend, Expo). These suggestions are part of the skill's primary functional purpose and target trusted vendor resources.
- [COMMAND_EXECUTION]: The skill can initiate the '/add' command to install recommended components. This execution is gated by explicit user confirmation and is restricted to the components matching the official vendor patterns.
Audit Metadata