convex-migrate-rehearse

Pass

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on standard npx convex CLI commands (such as export, deploy, import, and run) to manage database states and deployments. These are legitimate operations within the context of the Convex development ecosystem.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The workflow involves creating a local production data export (snapshot.zip) for seeding rehearsal environments. The skill mitigates this risk by explicitly instructing the agent and user to treat the snapshot as sensitive, avoid committing it to version control, and delete it immediately after the migration is complete.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with production data during the verification phase (running queries against the migrated preview). While this introduces a surface where data-resident content could potentially influence the agent's output, it is a standard part of database migration workflows.
  • Ingestion points: Production data is ingested via npx convex import into temporary preview deployments.
  • Boundary markers: No specific delimiters or instruction-bypass warnings are defined for the data processed during smoke queries.
  • Capability inventory: The skill has the capability to execute queries (npx convex run), deploy code (npx convex deploy), and write to the filesystem (creating snapshot.zip).
  • Sanitization: The skill does not implement specific sanitization for the data being migrated, as the purpose is to validate the data against a new schema.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 12, 2026, 03:14 PM
Security Audit — agent-trust-hub — convex-migrate-rehearse