convex-migrations

Pass

Audited by Gen Agent Trust Hub on Apr 1, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches documentation from official Convex domains (docs.convex.dev, stack.convex.dev) and uses a well-known avatar generation service (api.dicebear.com) in code examples.
  • [COMMAND_EXECUTION]: References standard Convex CLI commands (npx convex dev, npx convex deploy) for deployment and development workflows, accompanied by explicit warnings to only run them when instructed.
  • [DATA_EXPOSURE]: Includes an Indirect Prompt Injection surface as the skill provides patterns for processing and transforming data from database tables.
  • Ingestion points: Reads data from database tables (e.g., users, posts) using ctx.db.query for processing during migrations.
  • Boundary markers: Absent. The provided code templates focus on logic and do not explicitly include delimiters or instructions to treat database content as untrusted input.
  • Capability inventory: Includes database write operations (ctx.db.patch, ctx.db.replace, ctx.db.insert) and the ability to schedule recursive background tasks via ctx.scheduler.runAfter.
  • Sanitization: Employs Convex's native validation system (v.string(), v.id(), etc.) for schema definitions and mutation arguments, providing basic type safety.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 1, 2026, 05:03 PM