function-creator

Pass

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: SAFE
Full Analysis
  • Prompt Injection (SAFE): No instructions found attempting to override system prompts or bypass safety filters. The language is strictly instructional and focused on the Convex framework.- Data Exposure & Exfiltration (SAFE): The skill demonstrates the use of environment variables (e.g., OPENAI_API_KEY) which is a standard security practice. There are no attempts to access sensitive system files like SSH keys or AWS credentials.- Obfuscation (SAFE): No encoded strings (Base64), zero-width characters, or hidden Unicode tags were detected in the documentation or code examples.- Unverifiable Dependencies & Remote Code Execution (SAFE): The skill references standard, well-known libraries like openai and @sendgrid/mail. It does not include commands to download and execute remote scripts via shell.- Indirect Prompt Injection (LOW): The skill demonstrates processing user-provided input (e.g., args.prompt). It mitigates risks by including a checklist for argument validation using the Convex v validator library.- Privilege Escalation & Persistence (SAFE): No commands related to sudo, system configuration modifications, or persistence mechanisms (cron, startup scripts) were found.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 17, 2026, 06:05 PM