convex-expert
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent to use
npx tscandnpx convex devfor code verification and deployment. These commands are standard for the framework and are used for their intended purpose.- [EXTERNAL_DOWNLOADS]: The skill recommends the use of official vendor packages such as@convex-dev/agentand@convex-dev/workflowfor implementing specific features.- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to read project-specific files likeconvex/schema.tsand generated guidelines. While this represents a potential ingestion point for untrusted data, it is a necessary part of the backend development workflow. - Ingestion points: Reads
convex/schema.tsandconvex/_generated/ai/guidelines.md(SKILL.md). - Boundary markers: None specified.
- Capability inventory: Executes shell commands (
npx) and writes files to theconvex/directory (SKILL.md). - Sanitization: No explicit sanitization of input files is mentioned.
Audit Metadata