convex-deploy-guard
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use standard Convex CLI commands such as
npx convex deploy,npx convex run, andnpx convex env list. These are identified as legitimate developer tools associated with the vendor's platform. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest local configuration data from files like
.env.localandconvex.jsonto identify deployment targets. - Ingestion points: Reads project configuration from
.env.localandconvex.json(SKILL.md). - Boundary markers: None explicitly defined for file reading, but the skill mandates a human-in-the-loop confirmation step ('ANNOUNCE in one line before any deployment-affecting command') which serves as a safety boundary.
- Capability inventory: Uses the Convex CLI (
npx convex) to perform deployments and environment management. - Sanitization: Relies on the user to verify the 'announced' target before execution.
Audit Metadata