convex-migrations
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches documentation from official Convex domains (docs.convex.dev, stack.convex.dev) and uses a well-known avatar generation service (api.dicebear.com) in code examples.
- [COMMAND_EXECUTION]: References standard Convex CLI commands (
npx convex dev,npx convex deploy) for deployment and development workflows, accompanied by explicit warnings to only run them when instructed. - [DATA_EXPOSURE]: Includes an Indirect Prompt Injection surface as the skill provides patterns for processing and transforming data from database tables.
- Ingestion points: Reads data from database tables (e.g.,
users,posts) usingctx.db.queryfor processing during migrations. - Boundary markers: Absent. The provided code templates focus on logic and do not explicitly include delimiters or instructions to treat database content as untrusted input.
- Capability inventory: Includes database write operations (
ctx.db.patch,ctx.db.replace,ctx.db.insert) and the ability to schedule recursive background tasks viactx.scheduler.runAfter. - Sanitization: Employs Convex's native validation system (
v.string(),v.id(), etc.) for schema definitions and mutation arguments, providing basic type safety.
Audit Metadata