add-eval
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local development commands via
bunandbunxto manage dependencies, perform code generation (bunx convex codegen), and run validation suites (bun run validate:answers). These commands are essential for the skill's primary function of developing Convex evaluations.- [REMOTE_CODE_EXECUTION]: The skill includes instructions to run tests generated by AI models usingexecSyncto call avitestbinary located within a project directory (MODEL_OUTPUT_DIR). This mechanism is an intended feature for verifying the output of AI models in a controlled testing environment.- [EXTERNAL_DOWNLOADS]: The skill retrieves documentation fromhttps://docs.convex.dev/llms.txtto gather technical context. As these resources are hosted on the vendor's official domain, the network operations are categorized as safe activities within the scope of the skill's purpose.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the processing of external documentation and user-provided evaluation concepts. - Ingestion points: External documentation fetched via
WebFetchand user-defined evaluation parameters. - Boundary markers: Not present; the instructions do not implement specific delimiters to separate external data from the primary instruction set.
- Capability inventory: The skill can write files, create directories, and execute shell commands (
execSync,bun). - Sanitization: The skill does not describe any specific mechanisms for filtering or sanitizing the content retrieved from external sources before it is processed by the agent.
Audit Metadata