convex-launch-readiness
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an aggregator for audit findings which serves as an ingestion point for potentially untrusted data from various audit tools.\n
- Ingestion points: Finding data gathered from convex-authz, convex-reviewer, convex-advisor, and convex-insights as described in the Workflow section of SKILL.md.\n
- Boundary markers: The skill enforces data structure using specs/finding.schema.json and specs/finding-report.schema.json to delimit finding content.\n
- Capability inventory: The skill can trigger fixes via fixCapability strings, migrate-rehearse, and suggest tools.\n
- Sanitization: It implements a 'confirmed findings only' policy for scoring and a mandatory user-acceptance gate before invoking any fix capability.\n- [DYNAMIC_EXECUTION]: The skill utilizes a dispatch mechanism to trigger fixer capabilities based on identity labels in the findings report. This dynamic behavior is mitigated by the use of internal capability references and a requirement for explicit user consent for each action.
Audit Metadata