convex-dev-static-hosting
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
@convex-dev/static-hostingpackage from the official npm registry to provide the necessary component files for static hosting. - [COMMAND_EXECUTION]: Instructions guide the agent to perform standard development tasks using
npm installfor dependency management andnpx convex runfor executing authenticated deployment functions such as asset recording and upload URL generation. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and deployment of frontend application assets, creating an attack surface for indirect prompt injection if the assets contain instructions targeted at the agent.
- Ingestion points: Static application assets (React/Vite build files) processed by the skill for deployment to Convex storage (
SKILL.md). - Boundary markers: Absent; there are no specific delimiters or instructions provided to the agent to disregard potential commands embedded within the application files.
- Capability inventory: File system interaction for asset management and execution of
npm/npxcommands for build and deployment processes. - Sanitization: None; the skill does not specify any validation or sanitization steps for the content of the files being uploaded.
Audit Metadata