convex-docs
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites which could contain malicious instructions.
- Ingestion points: Fetches documentation from docs.convex.dev and general web search results as described in SKILL.md.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for the ingested content.
- Capability inventory: The skill can execute shell commands via node -p and read local files in node_modules.
- Sanitization: No sanitization or validation of the fetched external documentation is mentioned.
- [COMMAND_EXECUTION]: The skill executes a shell command to read version information from local files.
- Evidence: node -p "require('./node_modules/convex/package.json').version" in SKILL.md.
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation from a remote server.
- Evidence: Requests are made to docs.convex.dev, which is a well-known service for Convex documentation.
Audit Metadata