suggest
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several packages under the
@convex-dev/NPM scope, such as@convex-dev/crons,@convex-dev/sharded-counter, and@convex-dev/workflow. These are vendor-owned resources used to improve the user's application architecture. - [COMMAND_EXECUTION]: The skill defines a workflow to execute an installation command (
/add <component>) only after obtaining explicit user consent following a suggestion. - [INDIRECT_PROMPT_INJECTION]: The skill monitors user-provided
codeSnippetsanduserAskto trigger suggestions. This analysis is passive and the skill is instructed to wait for a completion of the current task and explicit user approval before taking any action, which mitigates risks from potentially malicious data in the codebase.
Audit Metadata