convex-self-heal
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a secure self-healing architecture with strong boundaries between automated triage and production deployment. While it processes external data, it does so within a highly controlled environment. Human-in-the-loop: The workflow explicitly enforces a merge gate ('Never auto-merges'), ensuring all machine-generated fixes are reviewed by a human before deployment. Verification and Isolation: Fixes are certified using TypeScript validation (tsc) and migration rehearsals on preview snapshots, preventing unverified code from reaching production. Data Protection: Production errors are redacted at write time to ensure data residency and privacy ('redacted at write time'). Indirect Injection Surface (Cat 8 Analysis): Ingestion points: Production error stacks and triggering inputs retrieved via MCP from the sentinel table; Boundary markers: None specified; Capability inventory: Access to tsc, migrate-rehearse, and convex-test within preview environments; Sanitization: Employs redaction and a mandatory human PR review gate as the final control.
Audit Metadata