convex-backup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npx convexto manage database exports, deployment creation, and data imports. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the database to perform integrity checks, which constitutes an attack surface where untrusted data could influence agent behavior.
- Ingestion points: Database row counts and record samples are retrieved via the
tablesandrunOneoffQuerytools during the assertion step inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing the sampled data.
- Capability inventory: The skill has the capability to execute CLI commands (
npx convex) and perform network operations through the Convex service. - Sanitization: There is no mention of sanitizing or escaping the content of the database records before they are processed by the agent for verification.
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and run theconvexpackage. This is a well-known service for users of the Convex platform.
Audit Metadata