auth
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Node.js one-liner to generate an RS256 private key and JWKS. This is done locally to provide a non-interactive alternative to CLI wizards. The results are stored in a temporary file .auth-keys.json which is deleted after the environment variables are configured.
- [EXTERNAL_DOWNLOADS]: Installs recognized dependencies including @convex-dev/auth (vendor-owned), jose (standard cryptography library), and UI primitives via npx shadcn@latest. These are standard resources in the target ecosystem.
- [SAFE]: Follows security best practices by instructing the agent to manage sensitive keys via environment variables on the deployment platform rather than hardcoding credentials or exposing them in insecure ways.
Audit Metadata