agent
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides developer guidance for integrating AI capabilities into the Convex backend. It explicitly recommends secure secret management by storing API keys in environment variables rather than client-side code.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of a 'chat with my docs' (RAG) feature, which establishes an ingestion surface for untrusted data. This is a common characteristic of such architectures and the instructions do not introduce specific vulnerabilities.\n
- Ingestion points: User-provided documents intended for vector search and retrieval (SKILL.md).\n
- Boundary markers: None specified in the high-level instructions.\n
- Capability inventory: Capability to retrieve from a vector index, trigger tool calls, and execute LLM messages (SKILL.md).\n
- Sanitization: Not specified for the content of the documents being embedded.
Audit Metadata