convex

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides standard CLI commands for project management and deployment within the Convex ecosystem.
  • npx convex dev for real-time development sync.
  • npx convex deploy for production deployment.
  • npx convex run for executing backend functions from the command line.
  • [EXTERNAL_DOWNLOADS]: Instructions include downloading official packages and interacting with well-known services.
  • Package installation: npm install convex, npm install better-auth.
  • External API calls: Examples using fetch to interact with SendGrid (api.sendgrid.com) and OpenAI (api.openai.com) using environment variables for authentication.
  • [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for retrieving data from databases and external APIs, creating a surface for indirect prompt injection.
  • Ingestion points: Data retrieved via ctx.db.query or fetch calls to third-party APIs.
  • Capability inventory: The skill can execute network requests (actions) and database writes (mutations).
  • Boundary markers and sanitization: The skill incorporates Convex's built-in schema validators (v.string(), v.id()) and provides a comprehensive disclaimer advising users to implement robust authorization and validation before production use.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 12:32 AM