function-creator
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- Prompt Injection (SAFE): No instructions found attempting to override system prompts or bypass safety filters. The language is strictly instructional and focused on the Convex framework.- Data Exposure & Exfiltration (SAFE): The skill demonstrates the use of environment variables (e.g.,
OPENAI_API_KEY) which is a standard security practice. There are no attempts to access sensitive system files like SSH keys or AWS credentials.- Obfuscation (SAFE): No encoded strings (Base64), zero-width characters, or hidden Unicode tags were detected in the documentation or code examples.- Unverifiable Dependencies & Remote Code Execution (SAFE): The skill references standard, well-known libraries likeopenaiand@sendgrid/mail. It does not include commands to download and execute remote scripts via shell.- Indirect Prompt Injection (LOW): The skill demonstrates processing user-provided input (e.g.,args.prompt). It mitigates risks by including a checklist for argument validation using the Convexvvalidator library.- Privilege Escalation & Persistence (SAFE): No commands related tosudo, system configuration modifications, or persistence mechanisms (cron, startup scripts) were found.
Audit Metadata