convex-quickstart
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided ideas and templates to drive the generation of backend and frontend code.
- Ingestion points: The
{idea, template}parameters are passed directly to the project scaffolding recipe in SKILL.md. - Capability inventory: The skill possesses the ability to execute shell commands via
npx, write files to the project directory, and deploy code to the Convex cloud backend. - Boundary markers: No specific boundary markers or 'ignore' instructions are used to separate the user-provided idea from the agent's instructions.
- Sanitization: There is no mention of input sanitization or validation for the user-provided idea before it influences code generation.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the application lifecycle and development environment. Key commands include
npx convex devfor starting the backend,npx convex whoamito verify authentication, andnpx tscfor type checking. These tools are standard for the Convex ecosystem and are used here to automate setup and verification. - [DYNAMIC_EXECUTION]: The skill generates application logic (Convex schemas and functions) based on user input and subsequently executes or verifies this code using
npx convex devandnpx tsc. This automated 'write-and-run' loop is a core feature for rapid development but involves executing dynamically generated content. - [EXTERNAL_DOWNLOADS]: The skill retrieves project templates and scaffolding logic via
quickstart-recipe@^2. As this resource originates from the vendor's own infrastructure, it is considered a legitimate functional dependency.
Audit Metadata