convex-setup-auth
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes secure authentication practices, specifically instructing the agent to verify user identities server-side using
ctx.auth.getUserIdentity()rather than relying on client-provided IDs. - [EXTERNAL_DOWNLOADS]: The instructions guide the installation of official libraries and CLI tools from well-known providers (e.g., Auth0 CLI, @clerk/clerk-react, @convex-dev/auth). These are standard dependencies for implementing the stated functionality and are sourced from trusted services.
- [COMMAND_EXECUTION]: The skill utilizes standard project initialization and development commands such as
npx convex dev,npx @convex-dev/auth, andauth0 login. These are legitimate operations for the skill's primary purpose and involve interactive user prompts where necessary. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data and external documentation.
- Ingestion points: Reads
package.json,convex.json, and environment variables from the user's repository; fetches content from official provider documentation URLs. - Boundary markers: None explicitly defined in the instructions for data isolation.
- Capability inventory: Executes shell commands (
npm install,npx,auth0 CLI) and writes configuration files to the local filesystem. - Sanitization: Relies on user confirmation and manual validation steps rather than programmatic sanitization of ingested content.
Audit Metadata