imessage-convex-agent
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The implementation follows security best practices by utilizing environment variables for all sensitive credentials (API keys and signing secrets) and performing constant-time comparisons for webhook authentication to prevent timing attacks.- [PROMPT_INJECTION]: As the skill is designed to process inbound messages from a public communication channel, it naturally presents a surface for indirect prompt injection. 1. Ingestion points: Untrusted data enters the system through the Sendblue webhook handler in
references/webhook-and-brain.ts. 2. Boundary markers: User text is appended to the system prompt inreferences/webhook-and-brain.tswithout explicit delimiters or 'ignore' instructions for embedded commands. 3. Capability inventory: The agent can perform Convex database mutations, storage operations, and send outbound messages via the Sendblue API. 4. Sanitization: Standard for chat agents; the skill relies on the underlying LLM's safety guardrails rather than explicit input filtering.
Audit Metadata