convex
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard CLI commands for project management and deployment within the Convex ecosystem.
npx convex devfor real-time development sync.npx convex deployfor production deployment.npx convex runfor executing backend functions from the command line.- [EXTERNAL_DOWNLOADS]: Instructions include downloading official packages and interacting with well-known services.
- Package installation:
npm install convex,npm install better-auth. - External API calls: Examples using
fetchto interact with SendGrid (api.sendgrid.com) and OpenAI (api.openai.com) using environment variables for authentication. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for retrieving data from databases and external APIs, creating a surface for indirect prompt injection.
- Ingestion points: Data retrieved via
ctx.db.queryorfetchcalls to third-party APIs. - Capability inventory: The skill can execute network requests (actions) and database writes (mutations).
- Boundary markers and sanitization: The skill incorporates Convex's built-in schema validators (
v.string(),v.id()) and provides a comprehensive disclaimer advising users to implement robust authorization and validation before production use.
Audit Metadata