seed

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute shell commands using npx convex run and npx convex import to manage database records.
  • [EXTERNAL_DOWNLOADS]: The skill relies on the convex package executed via npx. As this is a resource provided by the vendor, it is considered a functional requirement.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data sources (CSV and JSON files) for database imports, which constitutes an ingestion surface for untrusted content.
  • Ingestion points: External CSV and JSON datasets provided by the user or project files.
  • Boundary markers: The instructions do not define specific delimiters or headers to prevent the agent from interpreting data content as instructions.
  • Capability inventory: The skill has the capability to execute shell commands (npx).
  • Sanitization: There are no explicit instructions for the agent to sanitize or validate the content of the data files before processing or importing them.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 07:59 AM