convex-suggest
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided code snippets and inquiries to match them against predefined Convex component rules, which constitutes an ingestion point for untrusted data.\n
- Ingestion points: The skill analyzes
codeSnippetsanduserAsk(SKILL.md).\n - Boundary markers: No explicit delimiters are used to separate untrusted user data from the skill's operational instructions.\n
- Capability inventory: The skill has the capability to suggest and trigger package installations using the
/add <component>command.\n - Sanitization: The risk is mitigated by the strict requirement for explicit human consent before any installation occurs, ensuring the user maintains control over the execution environment.
Audit Metadata