convex-authz
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests local source code from convex//*.ts files to perform audits. This presents a surface for indirect prompt injection, where malicious instructions hidden in code comments could attempt to influence the agent's behavior. Ingestion points: Local application source code (convex//*.ts). Boundary markers: The skill uses a structured workflow with deterministic regex-based scanning to constrain the agent's logic. Capability inventory: The agent has the ability to read and write local files and execute shell commands (npx tsc). Sanitization: No specific sanitization or filtering of the ingested source code is described beyond the regex scanning.
- [COMMAND_EXECUTION]: The skill executes the command 'npx tsc --noEmit' to verify that hardening changes do not introduce type errors. This is a standard use of developer tooling within the project context.
Audit Metadata