convex-deploy-guard
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the Convex CLI (e.g.,
npx convex deploy,npx convex run) as part of its operational workflow for managing cloud functions and database deployments. - [DATA_EXFILTRATION]: To determine the deployment environment, the skill accesses local configuration files such as
.env.localandconvex.json, and reads theCONVEX_DEPLOY_KEY. This data is used for classification and context announcement; no network exfiltration of this data is present. - [INDIRECT_PROMPT_INJECTION]: The skill ingests configuration data from local files, which creates a potential surface for indirect prompt injection if those files were to be modified with malicious content. 1. Ingestion points: Target classification reads from
.env.localandconvex.json(SKILL.md). 2. Boundary markers: Absent; there are no specific delimiting instructions for these file contents. 3. Capability inventory: Executes Convex CLI commands and interacts with MCP tools. 4. Sanitization: Absent; no validation logic is specified for the file content before classification.
Audit Metadata