convex-expert

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local project files such as convex/schema.ts and convex/_generated/ai/guidelines.md to inform its code generation tasks. This creates an indirect prompt injection surface where content in these files could potentially influence agent behavior. However, this is a standard operational requirement for a coding assistant. • Ingestion points: Local project schema and guidelines files. • Boundary markers: None. • Capability inventory: File writing and CLI command execution. • Sanitization: None.
  • [COMMAND_EXECUTION]: The skill instructions include the use of platform-specific CLI commands such as npx convex dev, npx convex push, and npx tsc. These are standard tools for managing development workflows, deployments, and type checking within the Convex ecosystem.
  • [EXTERNAL_DOWNLOADS]: The skill recommends the installation of official platform utilities like convex-helpers and various @convex-dev components. It also mentions integration with well-known external APIs like Open-Meteo and Nominatim for specific functionalities. These references are consistent with standard development practices for the target platform.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:19 AM
Security Audit — agent-trust-hub — convex-expert