add-eval

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local development commands via bun and bunx to manage dependencies, perform code generation (bunx convex codegen), and run validation suites (bun run validate:answers). These commands are essential for the skill's primary function of developing Convex evaluations.- [REMOTE_CODE_EXECUTION]: The skill includes instructions to run tests generated by AI models using execSync to call a vitest binary located within a project directory (MODEL_OUTPUT_DIR). This mechanism is an intended feature for verifying the output of AI models in a controlled testing environment.- [EXTERNAL_DOWNLOADS]: The skill retrieves documentation from https://docs.convex.dev/llms.txt to gather technical context. As these resources are hosted on the vendor's official domain, the network operations are categorized as safe activities within the scope of the skill's purpose.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the processing of external documentation and user-provided evaluation concepts.
  • Ingestion points: External documentation fetched via WebFetch and user-defined evaluation parameters.
  • Boundary markers: Not present; the instructions do not implement specific delimiters to separate external data from the primary instruction set.
  • Capability inventory: The skill can write files, create directories, and execute shell commands (execSync, bun).
  • Sanitization: The skill does not describe any specific mechanisms for filtering or sanitizing the content retrieved from external sources before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 03:02 PM
Security Audit — agent-trust-hub — add-eval