convex-insights
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill is designed exclusively for read-only observability of Convex deployments. It explicitly instructs the agent to avoid enabling mutation flags and to maintain a 'deploy-guard' discipline, ensuring that log analysis cannot inadvertently modify production state.
- [INDIRECT_PROMPT_INJECTION]: The skill processes application logs, which are an external data source subject to user influence. It implements effective mitigations by requiring the agent to aggregate results (e.g., counts by function/message) and provide summarized evidence rather than returning raw log content. This structured approach prevents the agent from interpreting log data as direct instructions.
- Ingestion points: Data retrieved from
logsandinsightstools defined in SKILL.md. - Boundary markers: Explicit instructions to aggregate evidence and avoid answering with raw log dumps.
- Capability inventory: Restricted to read-only diagnostic tools (
logs,insights,functionSpec,status). - Sanitization: Recommended workflow focuses on client-side filtering and ranking of events to prevent raw data echoing.
Audit Metadata