convex-expert
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
npxfor self-verification of code. These includenpx tsc --noEmitto check for compilation errors andnpx convex dev --onceto verify the deployment state against the Convex backend. - [INDIRECT_PROMPT_INJECTION]: The agent is directed to ingest content from
convex/_generated/ai/guidelines.mdif it exists. As this file is processed as instructions for the agent's workflow and could potentially be modified by other processes or external inputs, it serves as a surface for indirect prompt injection. - Ingestion points:
convex/_generated/ai/guidelines.md(identified inSKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within this file.
- Capability inventory: The skill has the ability to execute shell commands via
npxand read/write files within theconvex/directory. - Sanitization: No sanitization or validation of the file content is specified before processing.
Audit Metadata