convex

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing standard development packages from the Convex ecosystem using official registries (e.g., npm install convex, @convex-dev/auth, @convex-dev/better-auth). These are legitimate dependencies for the stated purpose.
  • [COMMAND_EXECUTION]: Includes standard CLI commands for the Convex platform (npx convex dev, npx convex deploy, npx convex run) and project initialization (npx create-next-app). These commands are necessary for developing and deploying applications on the Convex backend.
  • [DATA_EXFILTRATION]: Contains code snippets demonstrating how to interact with well-known services such as SendGrid (api.sendgrid.com) and OpenAI (api.openai.com) via HTTP fetch within Convex Actions. These examples illustrate standard backend integrations for sending emails and generating AI embeddings.
  • [CREDENTIALS_UNSAFE]: Mentions best practices for managing environment variables using .env.local and accessing them securely through process.env within the Convex environment. No hardcoded secrets or sensitive path exposures were found.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 12:26 AM
Security Audit — agent-trust-hub — convex