convex-http-actions
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and templates for implementing Convex HTTP actions, teaching the agent how to build webhooks and REST APIs.
- [SAFE]: It correctly advocates for storing sensitive credentials (e.g.,
STRIPE_WEBHOOK_SECRET,CLERK_WEBHOOK_SECRET) in environment variables viaprocess.envrather than hardcoding them in scripts. - [SAFE]: It includes robust patterns for HMAC signature verification and svix header validation to secure webhooks from third-party services like Stripe, Clerk, and Resend.
- [SAFE]: It recommends using internal functions (
internalMutation,internalQuery) for database operations to ensure that database logic is not directly exposed as a public endpoint, adhering to the principle of least privilege. - [SAFE]: CORS configuration guidelines are provided with a focus on using restricted origins (
CLIENT_ORIGIN) for production environments to prevent cross-origin attacks.
Audit Metadata