convex-create-component

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the user to run standard Convex CLI tools including npx convex dev, npx convex codegen, and npx create-convex. These commands are used for code generation, type checking, and environment synchronization within the official development ecosystem.
  • [EXTERNAL_DOWNLOADS]: The skill references official and widely-used ecosystem packages, including @convex-dev/auth, convex-helpers, and convex-test. These are standard dependencies for building, testing, and securing Convex applications.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a functional surface for indirect prompt injection as it ingests user requirements to generate backend code and schemas.
  • Ingestion points: User-provided descriptions of desired features and goals during the initial design phase.
  • Boundary markers: The instructions explicitly enforce architectural boundaries between the 'app' and the 'component', such as requiring parent IDs to be passed as strings and keeping authentication (ctx.auth) and environment access (process.env) within the main application layer.
  • Capability inventory: The skill facilitates file creation and code modification through structured component directory management and CLI-driven generation.
  • Sanitization: The skill requires explicit type contracts using Convex validators (args and returns) for all public component functions, which mitigates data structure confusion and ensures schema adherence.
  • [DYNAMIC_EXECUTION]: The skill uses automated code generation (npx convex codegen) which populates _generated/ directories with TypeScript files that are subsequently imported by the application. This is a standard part of the platform's build process for maintaining type safety and API consistency.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:28 AM
Security Audit — agent-trust-hub — convex-create-component