convex-dev-static-hosting

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the @convex-dev/static-hosting package from the official npm registry to provide the necessary component files for static hosting.
  • [COMMAND_EXECUTION]: Instructions guide the agent to perform standard development tasks using npm install for dependency management and npx convex run for executing authenticated deployment functions such as asset recording and upload URL generation.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and deployment of frontend application assets, creating an attack surface for indirect prompt injection if the assets contain instructions targeted at the agent.
  • Ingestion points: Static application assets (React/Vite build files) processed by the skill for deployment to Convex storage (SKILL.md).
  • Boundary markers: Absent; there are no specific delimiters or instructions provided to the agent to disregard potential commands embedded within the application files.
  • Capability inventory: File system interaction for asset management and execution of npm/npx commands for build and deployment processes.
  • Sanitization: None; the skill does not specify any validation or sanitization steps for the content of the files being uploaded.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 07:41 PM