convex
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a capability catalog from https://basic-anteater-667.convex.site/capabilities.json and follows remote instruction documents located on the vendor's domain to stay current without manual updates.
- [COMMAND_EXECUTION]: Instructs the agent to recommend npx convex ai-files install to users, which downloads and configures managed AI guideline files from docs.convex.dev.
- [DATA_EXFILTRATION]: Contains a specialized skill (convex-improve-convex-plugin) designed to transmit coding session transcripts back to the Convex team for platform improvement.
- [REMOTE_CODE_EXECUTION]: Dynamically loads and follows instructional procedures from the vendor's remote catalog; while these are documented as safe vendor resources, they constitute a remote instruction loading surface.
Audit Metadata