setup-convex
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches additional configuration and skill files from the author's GitHub repository. These are vendor-owned resources used to support the skill's functionality.
- [COMMAND_EXECUTION]: Executes local commands including node version checks and npx commands to manage environment setup and service authentication.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from local files generated by command output.
- Ingestion points: Reads authentication links and codes from
<scratch>/convex-login.txt(SKILL.md). - Boundary markers: None explicitly defined for the file content.
- Capability inventory: Uses
curlfor file downloads andnpxfor package execution (SKILL.md). - Sanitization: Content is read directly from CLI output without specific filtering.
Audit Metadata