convex-sentinel

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @convex-dev/sentinel Node.js package, which is a component provided by the vendor for production monitoring.
  • [PROMPT_INJECTION]: The skill establishes an automated pipeline where untrusted production error logs are ingested and used by an AI agent to generate pull requests.
  • Ingestion points: Production error logs, including server function failures and client crashes, are stored in a deployment table (SKILL.md).
  • Boundary markers: None explicitly defined in the skill instructions to separate log data from agent instructions.
  • Capability inventory: The system uses a 'triage' component and an 'ai-runner' with the ability to open fix pull requests based on error data (SKILL.md).
  • Sanitization: Features mandatory 'default-deny' redaction for secrets and value patterns at write time to mitigate the risk of exposing sensitive data to the model (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 05:25 PM
Security Audit — agent-trust-hub — convex-sentinel