convex-performance-audit
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill utilizes
npxto execute the Convex CLI (npx convex insights). This involves downloading and running the official vendor tool for the platform being audited. Given the author matches the vendor, this is a standard and safe operational procedure. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it analyzes project source code and CLI output.
- Ingestion points: The agent reads project files and output from the
npx convex insightscommand inSKILL.md. - Boundary markers: Absent. The instructions do not define specific delimiters for analyzed code or CLI data.
- Capability inventory: The skill allows the agent to execute shell commands via
npxand suggests modifications to the project's source code. - Sanitization: Absent. No explicit validation or filtering logic is provided for the external data being processed.
Audit Metadata