convex
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill provides legitimate documentation and code examples for the Convex platform.
- [EXTERNAL_DOWNLOADS]: Fetches dependencies and tools from established sources like npm and the official Convex CLI. All mentioned packages (@convex-dev/auth, clerk, better-auth, etc.) are well-known in the developer community.
- [COMMAND_EXECUTION]: Includes standard development commands (npx convex dev, npx convex deploy) used for project initialization and deployment to the Convex cloud service.
- [SAFE]: Indirect Prompt Injection: The skill handles untrusted data through HTTP actions and mutations. Risk is mitigated by the mandatory use of Convex's validation library (v.string, v.id, etc.) which ensures data conforms to a predefined schema. 1. Ingestion points: convex/tasks.ts (function arguments) and convex/http.ts (request body). 2. Boundary markers: Not explicitly used for prompt isolation, but schema enforcement is present at the database layer. 3. Capability inventory: Database read/write operations (ctx.db), external network requests (fetch in actions), and task scheduling (ctx.scheduler). 4. Sanitization: Enforced via the 'convex/values' validator library.
Audit Metadata