convex-tanstack
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate templates and documentation for a standard web development stack. All external resources and packages referenced (e.g., Convex, TanStack, Better Auth, Resend) are well-known services within the developer ecosystem.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a vulnerability surface by teaching how to ingest untrusted data (user inputs, file uploads) and perform actions based on it (API calls, database writes). However, this is inherent to the educational purpose of the skill and follows best practices for structural validation.
- Ingestion points: User forms in
references/03-auth.md, query/mutation arguments inreferences/05-backend.md, and file uploads inreferences/07-storage.md. - Boundary markers: The skill consistently instructs the use of Convex validators (
v.string(),v.id(),v.union()) in schema definitions and function signatures to enforce strict data typing. - Capability inventory: Database writes via mutations, network operations via actions (e.g., calling Resend API in
references/05-backend.md), and CLI execution via deployment guides inreferences/12-deployment.md. - Sanitization: Enforced through Convex's built-in structural validators and type safety mechanisms.
Audit Metadata