convex-expert
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform code verification using platform-specific CLI tools.
- Evidence: Executes
npx tsc --noEmitandCONVEX_AGENT_MODE=anonymous npx convex dev --onceto ensure the generated Convex backend code compiles and deploys correctly. - [INDIRECT_PROMPT_INJECTION]: The skill consumes data from local project files that could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Reads
convex/schema.tsandconvex/_generated/ai/guidelines.md(found inSKILL.md) to inform its code generation. - Boundary markers: Absent. The skill does not define specific delimiters or warnings to ignore embedded instructions within these files.
- Capability inventory: The skill has the capability to write files to the
convex/directory and execute shell commands (npx tsc,npx convex). - Sanitization: Absent. There is no evidence of sanitization, validation, or filtering of the content read from the external project files.
Audit Metadata