convex-create-component
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the user to run standard Convex CLI tools including
npx convex dev,npx convex codegen, andnpx create-convex. These commands are used for code generation, type checking, and environment synchronization within the official development ecosystem. - [EXTERNAL_DOWNLOADS]: The skill references official and widely-used ecosystem packages, including
@convex-dev/auth,convex-helpers, andconvex-test. These are standard dependencies for building, testing, and securing Convex applications. - [INDIRECT_PROMPT_INJECTION]: The skill has a functional surface for indirect prompt injection as it ingests user requirements to generate backend code and schemas.
- Ingestion points: User-provided descriptions of desired features and goals during the initial design phase.
- Boundary markers: The instructions explicitly enforce architectural boundaries between the 'app' and the 'component', such as requiring parent IDs to be passed as strings and keeping authentication (
ctx.auth) and environment access (process.env) within the main application layer. - Capability inventory: The skill facilitates file creation and code modification through structured component directory management and CLI-driven generation.
- Sanitization: The skill requires explicit type contracts using Convex validators (
argsandreturns) for all public component functions, which mitigates data structure confusion and ensures schema adherence. - [DYNAMIC_EXECUTION]: The skill uses automated code generation (
npx convex codegen) which populates_generated/directories with TypeScript files that are subsequently imported by the application. This is a standard part of the platform's build process for maintaining type safety and API consistency.
Audit Metadata