seed
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using
npx convex runandnpx convex importto manage database records. - [EXTERNAL_DOWNLOADS]: The skill relies on the
convexpackage executed vianpx. As this is a resource provided by the vendor, it is considered a functional requirement. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources (CSV and JSON files) for database imports, which constitutes an ingestion surface for untrusted content.
- Ingestion points: External CSV and JSON datasets provided by the user or project files.
- Boundary markers: The instructions do not define specific delimiters or headers to prevent the agent from interpreting data content as instructions.
- Capability inventory: The skill has the capability to execute shell commands (
npx). - Sanitization: There are no explicit instructions for the agent to sanitize or validate the content of the data files before processing or importing them.
Audit Metadata