convex-auth

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install @convex-dev/auth, jose, and UI components via npx shadcn@latest. These are legitimate vendor resources and standard development tools.
  • [COMMAND_EXECUTION]: Uses a node one-liner to generate RSA keys locally. The generated keys are stored in a temporary file .auth-keys.json which the skill explicitly instructs the user/agent to delete after setting environment variables.
  • [CREDENTIALS_UNSAFE]: The skill manages authentication secrets (JWT_PRIVATE_KEY). It follows a secure pattern of generating these keys on the fly for the specific deployment and uploading them to environment variables rather than using hardcoded values.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 03:14 PM
Security Audit — agent-trust-hub — convex-auth