convex-design
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
npx tsc --noEmitandnpx convex dev --onceto verify the generated backend code. These are standard operations for the Convex development environment and are used to ensure code quality before deployment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input in the form of plain-English product ideas to guide code generation and verification.
- Ingestion points: User-provided product descriptions and backend requirements entering the agent context.
- Boundary markers: Absent; there are no specific instructions to delimit or ignore embedded instructions within user-provided product asks.
- Capability inventory: The skill is capable of writing TypeScript files to the
convex/directory and executing shell commands throughnpx(TSC and Convex CLI). - Sanitization: Absent; the skill does not explicitly describe sanitization or filtering of the user's product requirements before using them to generate logic or code.
Audit Metadata