convex-create-component
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run development commands such as
npx convex devandnpx convex codegento manage the local environment and generate type definitions. These tools are official components of the Convex platform ecosystem. - [EXTERNAL_DOWNLOADS]: The skill references downloading official initialization scripts via
npx create-convexand utilizing established libraries like@convex-dev/authfrom the public NPM registry. - [REMOTE_CODE_EXECUTION]: The execution of
npxcommands involves the dynamic retrieval and execution of packages from the NPM registry. These operations are performed using official platform tooling intended for development workflows. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user descriptions to generate code and execute management commands, creating a potential surface for indirect instruction injection.
- Ingestion points: User prompts regarding component goals and requirements in SKILL.md.
- Boundary markers: Absent; there are no specific markers used to delimit user-provided content during interpolation.
- Capability inventory: File system write access and shell command execution (
npx convex dev) in SKILL.md and references/packaged-components.md. - Sanitization: Absent; the skill does not explicitly validate or sanitize user input before incorporating it into the generated component structure.
Audit Metadata