convex-sentinel
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@convex-dev/sentinelNode.js package, which is a component provided by the vendor for production monitoring. - [PROMPT_INJECTION]: The skill establishes an automated pipeline where untrusted production error logs are ingested and used by an AI agent to generate pull requests.
- Ingestion points: Production error logs, including server function failures and client crashes, are stored in a deployment table (SKILL.md).
- Boundary markers: None explicitly defined in the skill instructions to separate log data from agent instructions.
- Capability inventory: The system uses a 'triage' component and an 'ai-runner' with the ability to open fix pull requests based on error data (SKILL.md).
- Sanitization: Features mandatory 'default-deny' redaction for secrets and value patterns at write time to mitigate the risk of exposing sensitive data to the model (SKILL.md).
Audit Metadata