convex-expert
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local project files such as
convex/schema.tsandconvex/_generated/ai/guidelines.mdto inform its code generation tasks. This creates an indirect prompt injection surface where content in these files could potentially influence agent behavior. However, this is a standard operational requirement for a coding assistant. • Ingestion points: Local project schema and guidelines files. • Boundary markers: None. • Capability inventory: File writing and CLI command execution. • Sanitization: None. - [COMMAND_EXECUTION]: The skill instructions include the use of platform-specific CLI commands such as
npx convex dev,npx convex push, andnpx tsc. These are standard tools for managing development workflows, deployments, and type checking within the Convex ecosystem. - [EXTERNAL_DOWNLOADS]: The skill recommends the installation of official platform utilities like
convex-helpersand various@convex-devcomponents. It also mentions integration with well-known external APIs like Open-Meteo and Nominatim for specific functionalities. These references are consistent with standard development practices for the target platform.
Audit Metadata