convex-docs

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (e.g., node -p) to read version information from package.json or node_modules/convex/package.json. This is a routine task for development tools to ensure compatibility.
  • [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting external data from the official documentation site.
  • Ingestion points: Markdown content fetched from docs.convex.dev and README files from @convex-dev/* packages.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified.
  • Capability inventory: The skill possesses the ability to execute shell commands (node), read local project files (node_modules), and perform network operations to fetch documentation.
  • Sanitization: No specific sanitization or filtering of the fetched documentation is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 05:25 PM
Security Audit — agent-trust-hub — convex-docs