convex-design
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to verify backend code using
npx tsc --noEmitandnpx convex dev --once. These are standard tools provided by the TypeScript and Convex ecosystems for project verification and deployment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements to generate code. While this is an untrusted data surface, the risk is mitigated as the skill's capabilities are restricted to generating backend code and running developer-led verification commands. 1. Ingestion points: Plain-English product ideas and technical asks in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: File writing and execution of standard npx commands in SKILL.md. 4. Sanitization: Absent.
Audit Metadata